Analysis
-
max time kernel
147s -
max time network
84s -
platform
windows7_x64 -
resource
win7 -
submitted
17-07-2020 15:38
Static task
static1
Behavioral task
behavioral1
Sample
Timsistem_Product_Specifications - 2020.07.17.exe
Resource
win7
General
-
Target
Timsistem_Product_Specifications - 2020.07.17.exe
-
Size
759KB
-
MD5
6998368a7e9f5e063f5b5a0090112545
-
SHA1
c7659c9e1b683d7044267b6960a30ca6473ca945
-
SHA256
cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb
-
SHA512
d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e
Malware Config
Signatures
-
Processes:
notepad.exeflow ioc 31 api.ipify.org 34 ip-api.com 2 ip-api.com File created C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe:ZoneIdentifier notepad.exe -
Executes dropped EXE 64 IoCs
Processes:
taskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exepid process 1600 taskmgr.exe 752 taskmgr.exe 1128 taskmgr.exe 1896 svchost.exe 1876 taskmgr.exe 1152 taskmgr.exe 1632 taskmgr.exe 1988 taskmgr.exe 2020 taskmgr.exe 2040 taskmgr.exe 1500 svchost.exe 1596 taskmgr.exe 864 taskmgr.exe 1036 taskmgr.exe 1852 taskmgr.exe 1060 taskmgr.exe 1908 taskmgr.exe 1652 svchost.exe 2024 taskmgr.exe 2016 taskmgr.exe 1564 taskmgr.exe 1056 taskmgr.exe 2020 taskmgr.exe 1048 taskmgr.exe 1692 svchost.exe 1128 taskmgr.exe 1852 taskmgr.exe 1576 taskmgr.exe 2004 taskmgr.exe 1556 taskmgr.exe 1584 taskmgr.exe 652 svchost.exe 1496 taskmgr.exe 1460 taskmgr.exe 792 taskmgr.exe 660 taskmgr.exe 1868 taskmgr.exe 1844 taskmgr.exe 1620 svchost.exe 1852 taskmgr.exe 1748 taskmgr.exe 1544 taskmgr.exe 1092 taskmgr.exe 1308 taskmgr.exe 1956 taskmgr.exe 1516 svchost.exe 1560 taskmgr.exe 1700 taskmgr.exe 1920 taskmgr.exe 1876 taskmgr.exe 1960 taskmgr.exe 468 taskmgr.exe 1332 svchost.exe 1476 taskmgr.exe 1464 taskmgr.exe 1164 taskmgr.exe 1044 taskmgr.exe 1460 taskmgr.exe 1412 taskmgr.exe 1128 svchost.exe 1808 taskmgr.exe 1844 taskmgr.exe 1568 taskmgr.exe 1672 taskmgr.exe -
Processes:
resource yara_rule behavioral1/memory/752-12-0x0000000000400000-0x00000000004D0000-memory.dmp upx behavioral1/memory/752-7-0x0000000000400000-0x00000000004D0000-memory.dmp upx behavioral1/memory/752-13-0x0000000000400000-0x00000000004D0000-memory.dmp upx -
Drops startup file 2 IoCs
Processes:
notepad.exenotepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs notepad.exe -
Loads dropped DLL 52 IoCs
Processes:
notepad.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exenotepad.exetaskmgr.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exepid process 240 notepad.exe 240 notepad.exe 752 taskmgr.exe 752 taskmgr.exe 2020 taskmgr.exe 1060 taskmgr.exe 2020 taskmgr.exe 1556 taskmgr.exe 1868 taskmgr.exe 1308 taskmgr.exe 1960 taskmgr.exe 1460 taskmgr.exe 1960 taskmgr.exe 1888 taskmgr.exe 1916 taskmgr.exe 1476 taskmgr.exe 2028 taskmgr.exe 2024 taskmgr.exe 1048 taskmgr.exe 1900 notepad.exe 1900 notepad.exe 1344 taskmgr.exe 1344 taskmgr.exe 1008 cmd.exe 1704 cmd.exe 960 cmd.exe 1052 cmd.exe 1844 cmd.exe 660 cmd.exe 1576 cmd.exe 1256 cmd.exe 1416 cmd.exe 1704 cmd.exe 888 cmd.exe 1816 cmd.exe 1584 cmd.exe 1484 cmd.exe 1212 cmd.exe 1136 cmd.exe 1340 cmd.exe 1920 cmd.exe 596 cmd.exe 1660 cmd.exe 1944 cmd.exe 1208 cmd.exe 1900 cmd.exe 1004 cmd.exe 1616 cmd.exe 944 cmd.exe 1780 cmd.exe 1256 cmd.exe 2240 cmd.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com 31 api.ipify.org 34 ip-api.com -
Drops file in System32 directory 64 IoCs
Processes:
taskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exedescription ioc process File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe\:ZoneIdentifier:$DATA taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe File created C:\Windows\SysWOW64\SubDir\svchost.exe taskmgr.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
taskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exedescription pid process target process PID 1600 set thread context of 752 1600 taskmgr.exe taskmgr.exe PID 1876 set thread context of 1152 1876 taskmgr.exe taskmgr.exe PID 1988 set thread context of 2020 1988 taskmgr.exe taskmgr.exe PID 1596 set thread context of 864 1596 taskmgr.exe taskmgr.exe PID 1852 set thread context of 1060 1852 taskmgr.exe taskmgr.exe PID 2024 set thread context of 2016 2024 taskmgr.exe taskmgr.exe PID 1056 set thread context of 2020 1056 taskmgr.exe taskmgr.exe PID 1128 set thread context of 1852 1128 taskmgr.exe taskmgr.exe PID 2004 set thread context of 1556 2004 taskmgr.exe taskmgr.exe PID 1496 set thread context of 1460 1496 taskmgr.exe taskmgr.exe PID 660 set thread context of 1868 660 taskmgr.exe taskmgr.exe PID 1852 set thread context of 1748 1852 taskmgr.exe taskmgr.exe PID 1092 set thread context of 1308 1092 taskmgr.exe taskmgr.exe PID 1560 set thread context of 1700 1560 taskmgr.exe taskmgr.exe PID 1876 set thread context of 1960 1876 taskmgr.exe taskmgr.exe PID 1476 set thread context of 1464 1476 taskmgr.exe taskmgr.exe PID 1044 set thread context of 1460 1044 taskmgr.exe taskmgr.exe PID 1808 set thread context of 1844 1808 taskmgr.exe taskmgr.exe PID 1672 set thread context of 1960 1672 taskmgr.exe taskmgr.exe PID 1824 set thread context of 1596 1824 taskmgr.exe taskmgr.exe PID 1376 set thread context of 1888 1376 taskmgr.exe taskmgr.exe PID 304 set thread context of 1448 304 taskmgr.exe taskmgr.exe PID 1964 set thread context of 1916 1964 taskmgr.exe taskmgr.exe PID 1992 set thread context of 1684 1992 taskmgr.exe taskmgr.exe PID 1888 set thread context of 1476 1888 taskmgr.exe taskmgr.exe PID 1560 set thread context of 1372 1560 taskmgr.exe taskmgr.exe PID 1908 set thread context of 2028 1908 taskmgr.exe taskmgr.exe PID 1816 set thread context of 1956 1816 taskmgr.exe taskmgr.exe PID 828 set thread context of 2024 828 taskmgr.exe taskmgr.exe PID 1584 set thread context of 1816 1584 taskmgr.exe taskmgr.exe PID 1460 set thread context of 1048 1460 taskmgr.exe taskmgr.exe PID 1964 set thread context of 1512 1964 taskmgr.exe taskmgr.exe PID 1308 set thread context of 1344 1308 taskmgr.exe taskmgr.exe PID 1172 set thread context of 1560 1172 taskmgr.exe taskmgr.exe PID 292 set thread context of 1200 292 taskmgr.exe taskmgr.exe PID 624 set thread context of 592 624 taskmgr.exe taskmgr.exe PID 328 set thread context of 972 328 taskmgr.exe taskmgr.exe PID 820 set thread context of 1792 820 taskmgr.exe taskmgr.exe PID 1288 set thread context of 1888 1288 taskmgr.exe taskmgr.exe PID 1612 set thread context of 1836 1612 taskmgr.exe taskmgr.exe PID 580 set thread context of 1392 580 taskmgr.exe taskmgr.exe PID 1924 set thread context of 1068 1924 taskmgr.exe taskmgr.exe PID 796 set thread context of 1716 796 taskmgr.exe taskmgr.exe PID 1624 set thread context of 1608 1624 taskmgr.exe taskmgr.exe PID 992 set thread context of 1004 992 taskmgr.exe taskmgr.exe PID 1264 set thread context of 536 1264 taskmgr.exe taskmgr.exe PID 1860 set thread context of 1888 1860 taskmgr.exe taskmgr.exe PID 1940 set thread context of 844 1940 taskmgr.exe taskmgr.exe PID 1824 set thread context of 1068 1824 taskmgr.exe taskmgr.exe PID 688 set thread context of 592 688 taskmgr.exe taskmgr.exe PID 908 set thread context of 1464 908 taskmgr.exe taskmgr.exe PID 276 set thread context of 1744 276 taskmgr.exe taskmgr.exe PID 964 set thread context of 580 964 taskmgr.exe taskmgr.exe PID 364 set thread context of 784 364 taskmgr.exe taskmgr.exe PID 1492 set thread context of 1240 1492 taskmgr.exe taskmgr.exe PID 1116 set thread context of 832 1116 taskmgr.exe taskmgr.exe PID 1472 set thread context of 2024 1472 taskmgr.exe taskmgr.exe PID 1996 set thread context of 1256 1996 taskmgr.exe taskmgr.exe PID 828 set thread context of 1048 828 taskmgr.exe taskmgr.exe PID 300 set thread context of 924 300 taskmgr.exe taskmgr.exe PID 1012 set thread context of 948 1012 taskmgr.exe taskmgr.exe PID 624 set thread context of 2032 624 taskmgr.exe taskmgr.exe PID 1184 set thread context of 364 1184 taskmgr.exe taskmgr.exe PID 592 set thread context of 984 592 taskmgr.exe taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 17 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1672 schtasks.exe 1884 schtasks.exe 1504 schtasks.exe 568 schtasks.exe 780 schtasks.exe 524 schtasks.exe 1932 schtasks.exe 1820 schtasks.exe 568 schtasks.exe 904 schtasks.exe 1164 schtasks.exe 1868 schtasks.exe 1460 schtasks.exe 1788 schtasks.exe 1472 schtasks.exe 1548 schtasks.exe 1496 schtasks.exe -
NTFS ADS 2 IoCs
Processes:
notepad.exenotepad.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe:ZoneIdentifier notepad.exe File created C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe:ZoneIdentifier notepad.exe -
Runs ping.exe 1 TTPs 45 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 1724 PING.EXE 840 PING.EXE 968 PING.EXE 2996 PING.EXE 672 PING.EXE 1596 PING.EXE 1208 PING.EXE 1268 PING.EXE 2308 PING.EXE 2928 PING.EXE 1992 PING.EXE 996 PING.EXE 1460 PING.EXE 1956 PING.EXE 1204 PING.EXE 836 PING.EXE 2360 PING.EXE 2692 PING.EXE 624 PING.EXE 1068 PING.EXE 296 PING.EXE 2948 PING.EXE 1412 PING.EXE 1184 PING.EXE 984 PING.EXE 1236 PING.EXE 1200 PING.EXE 604 PING.EXE 1352 PING.EXE 1716 PING.EXE 2996 PING.EXE 2304 PING.EXE 2304 PING.EXE 2452 PING.EXE 1188 PING.EXE 1880 PING.EXE 1860 PING.EXE 2604 PING.EXE 2872 PING.EXE 2064 PING.EXE 2008 PING.EXE 1708 PING.EXE 1788 PING.EXE 908 PING.EXE 1192 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Timsistem_Product_Specifications - 2020.07.17.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exepid process 1496 Timsistem_Product_Specifications - 2020.07.17.exe 1600 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1896 svchost.exe 1128 taskmgr.exe 1876 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1632 taskmgr.exe 1988 taskmgr.exe 2040 taskmgr.exe 2040 taskmgr.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
taskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exepid process 1600 taskmgr.exe 1876 taskmgr.exe 1988 taskmgr.exe 1596 taskmgr.exe 1852 taskmgr.exe 2024 taskmgr.exe 1056 taskmgr.exe 1128 taskmgr.exe 2004 taskmgr.exe 1496 taskmgr.exe 660 taskmgr.exe 1852 taskmgr.exe 1092 taskmgr.exe 1560 taskmgr.exe 1876 taskmgr.exe 1476 taskmgr.exe 1044 taskmgr.exe 1808 taskmgr.exe 1672 taskmgr.exe 1824 taskmgr.exe 1376 taskmgr.exe 304 taskmgr.exe 1964 taskmgr.exe 1992 taskmgr.exe 1888 taskmgr.exe 1560 taskmgr.exe 1908 taskmgr.exe 1816 taskmgr.exe 828 taskmgr.exe 1584 taskmgr.exe 1460 taskmgr.exe 1964 taskmgr.exe 1308 taskmgr.exe 1172 taskmgr.exe 292 taskmgr.exe 624 taskmgr.exe 820 taskmgr.exe 328 taskmgr.exe 1288 taskmgr.exe 1612 taskmgr.exe 580 taskmgr.exe 1924 taskmgr.exe 796 taskmgr.exe 1624 taskmgr.exe 992 taskmgr.exe 1264 taskmgr.exe 1860 taskmgr.exe 1940 taskmgr.exe 1824 taskmgr.exe 688 taskmgr.exe 908 taskmgr.exe 276 taskmgr.exe 964 taskmgr.exe 364 taskmgr.exe 1492 taskmgr.exe 1116 taskmgr.exe 1472 taskmgr.exe 1996 taskmgr.exe 828 taskmgr.exe 300 taskmgr.exe 1012 taskmgr.exe 624 taskmgr.exe 1184 taskmgr.exe 592 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
taskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 752 taskmgr.exe Token: SeDebugPrivilege 1152 taskmgr.exe Token: SeDebugPrivilege 2020 taskmgr.exe Token: SeDebugPrivilege 864 taskmgr.exe Token: SeDebugPrivilege 1060 taskmgr.exe Token: SeDebugPrivilege 2016 taskmgr.exe Token: SeDebugPrivilege 2020 taskmgr.exe Token: SeDebugPrivilege 1852 taskmgr.exe Token: SeDebugPrivilege 1556 taskmgr.exe Token: SeDebugPrivilege 1460 taskmgr.exe Token: SeDebugPrivilege 1868 taskmgr.exe Token: SeDebugPrivilege 1748 taskmgr.exe Token: SeDebugPrivilege 1308 taskmgr.exe Token: SeDebugPrivilege 1700 taskmgr.exe Token: SeDebugPrivilege 1960 taskmgr.exe Token: SeDebugPrivilege 1464 taskmgr.exe Token: SeDebugPrivilege 1460 taskmgr.exe Token: SeDebugPrivilege 1844 taskmgr.exe Token: SeDebugPrivilege 1960 taskmgr.exe Token: SeDebugPrivilege 1596 taskmgr.exe Token: SeDebugPrivilege 1888 taskmgr.exe Token: SeDebugPrivilege 1448 taskmgr.exe Token: SeDebugPrivilege 1916 taskmgr.exe Token: SeDebugPrivilege 1684 taskmgr.exe Token: SeDebugPrivilege 1476 taskmgr.exe Token: SeDebugPrivilege 1372 taskmgr.exe Token: SeDebugPrivilege 2028 taskmgr.exe Token: SeDebugPrivilege 1956 taskmgr.exe Token: SeDebugPrivilege 2024 taskmgr.exe Token: SeDebugPrivilege 1816 taskmgr.exe Token: SeDebugPrivilege 1048 taskmgr.exe Token: SeDebugPrivilege 1344 taskmgr.exe Token: SeDebugPrivilege 1512 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Timsistem_Product_Specifications - 2020.07.17.exenotepad.exetaskmgr.exetaskmgr.exesvchost.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exedescription pid process target process PID 1496 wrote to memory of 240 1496 Timsistem_Product_Specifications - 2020.07.17.exe notepad.exe PID 1496 wrote to memory of 240 1496 Timsistem_Product_Specifications - 2020.07.17.exe notepad.exe PID 1496 wrote to memory of 240 1496 Timsistem_Product_Specifications - 2020.07.17.exe notepad.exe PID 1496 wrote to memory of 240 1496 Timsistem_Product_Specifications - 2020.07.17.exe notepad.exe PID 1496 wrote to memory of 240 1496 Timsistem_Product_Specifications - 2020.07.17.exe notepad.exe PID 1496 wrote to memory of 240 1496 Timsistem_Product_Specifications - 2020.07.17.exe notepad.exe PID 240 wrote to memory of 1600 240 notepad.exe taskmgr.exe PID 240 wrote to memory of 1600 240 notepad.exe taskmgr.exe PID 240 wrote to memory of 1600 240 notepad.exe taskmgr.exe PID 240 wrote to memory of 1600 240 notepad.exe taskmgr.exe PID 1600 wrote to memory of 752 1600 taskmgr.exe taskmgr.exe PID 1600 wrote to memory of 752 1600 taskmgr.exe taskmgr.exe PID 1600 wrote to memory of 752 1600 taskmgr.exe taskmgr.exe PID 1600 wrote to memory of 752 1600 taskmgr.exe taskmgr.exe PID 1600 wrote to memory of 1128 1600 taskmgr.exe taskmgr.exe PID 1600 wrote to memory of 1128 1600 taskmgr.exe taskmgr.exe PID 1600 wrote to memory of 1128 1600 taskmgr.exe taskmgr.exe PID 1600 wrote to memory of 1128 1600 taskmgr.exe taskmgr.exe PID 752 wrote to memory of 1868 752 taskmgr.exe schtasks.exe PID 752 wrote to memory of 1868 752 taskmgr.exe schtasks.exe PID 752 wrote to memory of 1868 752 taskmgr.exe schtasks.exe PID 752 wrote to memory of 1868 752 taskmgr.exe schtasks.exe PID 752 wrote to memory of 1896 752 taskmgr.exe svchost.exe PID 752 wrote to memory of 1896 752 taskmgr.exe svchost.exe PID 752 wrote to memory of 1896 752 taskmgr.exe svchost.exe PID 752 wrote to memory of 1896 752 taskmgr.exe svchost.exe PID 1896 wrote to memory of 1828 1896 svchost.exe notepad.exe PID 1896 wrote to memory of 1828 1896 svchost.exe notepad.exe PID 1896 wrote to memory of 1828 1896 svchost.exe notepad.exe PID 1896 wrote to memory of 1828 1896 svchost.exe notepad.exe PID 1896 wrote to memory of 1828 1896 svchost.exe notepad.exe PID 1896 wrote to memory of 1828 1896 svchost.exe notepad.exe PID 1128 wrote to memory of 1876 1128 taskmgr.exe taskmgr.exe PID 1128 wrote to memory of 1876 1128 taskmgr.exe taskmgr.exe PID 1128 wrote to memory of 1876 1128 taskmgr.exe taskmgr.exe PID 1128 wrote to memory of 1876 1128 taskmgr.exe taskmgr.exe PID 1876 wrote to memory of 1152 1876 taskmgr.exe taskmgr.exe PID 1876 wrote to memory of 1152 1876 taskmgr.exe taskmgr.exe PID 1876 wrote to memory of 1152 1876 taskmgr.exe taskmgr.exe PID 1876 wrote to memory of 1152 1876 taskmgr.exe taskmgr.exe PID 1876 wrote to memory of 1632 1876 taskmgr.exe taskmgr.exe PID 1876 wrote to memory of 1632 1876 taskmgr.exe taskmgr.exe PID 1876 wrote to memory of 1632 1876 taskmgr.exe taskmgr.exe PID 1876 wrote to memory of 1632 1876 taskmgr.exe taskmgr.exe PID 1632 wrote to memory of 1988 1632 taskmgr.exe taskmgr.exe PID 1632 wrote to memory of 1988 1632 taskmgr.exe taskmgr.exe PID 1632 wrote to memory of 1988 1632 taskmgr.exe taskmgr.exe PID 1632 wrote to memory of 1988 1632 taskmgr.exe taskmgr.exe PID 1988 wrote to memory of 2020 1988 taskmgr.exe taskmgr.exe PID 1988 wrote to memory of 2020 1988 taskmgr.exe taskmgr.exe PID 1988 wrote to memory of 2020 1988 taskmgr.exe taskmgr.exe PID 1988 wrote to memory of 2020 1988 taskmgr.exe taskmgr.exe PID 1988 wrote to memory of 2040 1988 taskmgr.exe taskmgr.exe PID 1988 wrote to memory of 2040 1988 taskmgr.exe taskmgr.exe PID 1988 wrote to memory of 2040 1988 taskmgr.exe taskmgr.exe PID 1988 wrote to memory of 2040 1988 taskmgr.exe taskmgr.exe PID 2020 wrote to memory of 1460 2020 taskmgr.exe schtasks.exe PID 2020 wrote to memory of 1460 2020 taskmgr.exe schtasks.exe PID 2020 wrote to memory of 1460 2020 taskmgr.exe schtasks.exe PID 2020 wrote to memory of 1460 2020 taskmgr.exe schtasks.exe PID 2020 wrote to memory of 1500 2020 taskmgr.exe svchost.exe PID 2020 wrote to memory of 1500 2020 taskmgr.exe svchost.exe PID 2020 wrote to memory of 1500 2020 taskmgr.exe svchost.exe PID 2020 wrote to memory of 1500 2020 taskmgr.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Timsistem_Product_Specifications - 2020.07.17.exe"C:\Users\Admin\AppData\Local\Temp\Timsistem_Product_Specifications - 2020.07.17.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Quasar RAT
- Drops startup file
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:1868 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"6⤵PID:1828
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 752 613084⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1152 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1152 657236⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f9⤵
- Creates scheduled task(s)
PID:1460 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"9⤵
- Executes dropped EXE
PID:1500 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"10⤵PID:452
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 2020 675178⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2040 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1596 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:864 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 864 6935810⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1852 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1060 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f13⤵
- Creates scheduled task(s)
PID:1932 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"13⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"14⤵PID:1952
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1060 7116712⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2024 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 2016 7319514⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1056 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f17⤵
- Creates scheduled task(s)
PID:1820 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"17⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"18⤵PID:1520
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 2020 7505216⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1128 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1852 7697018⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2004 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f21⤵
- Creates scheduled task(s)
PID:1548 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"21⤵
- Executes dropped EXE
PID:652 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"22⤵PID:1432
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1556 7881120⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1496 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1460 8090222⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:660 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f25⤵
- Creates scheduled task(s)
PID:568 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"25⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"26⤵PID:1572
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1868 8275824⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1852 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1748 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1748 8447426⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1092 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1308 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f29⤵
- Creates scheduled task(s)
PID:1504 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"29⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"30⤵PID:1864
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1308 8622128⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1560 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1700 8803130⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1876 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f33⤵
- Creates scheduled task(s)
PID:904 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"33⤵
- Executes dropped EXE
PID:1332 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"34⤵PID:1748
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1960 8980932⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1476 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1464 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1464 9158834⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1044 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"36⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f37⤵
- Creates scheduled task(s)
PID:568 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"37⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"38⤵PID:1628
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1460 9330436⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1808 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1844 9498938⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1672 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"40⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f41⤵
- Creates scheduled task(s)
PID:1496 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"41⤵PID:2016
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"42⤵PID:520
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1960 9690740⤵PID:468
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1824 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"42⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1596 9863942⤵PID:1048
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1376 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"44⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1888 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f45⤵
- Creates scheduled task(s)
PID:780 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"45⤵PID:1152
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"46⤵PID:2044
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1888 10049544⤵PID:1996
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"45⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:304 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"46⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1448 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1448 10211846⤵PID:752
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1964 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"48⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1916 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f49⤵
- Creates scheduled task(s)
PID:524 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"49⤵PID:568
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"50⤵PID:1376
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1916 10386548⤵PID:308
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"49⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1992 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"50⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1684 10565950⤵PID:1844
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1888 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"52⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f53⤵
- Creates scheduled task(s)
PID:1788 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"53⤵PID:792
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"54⤵PID:1304
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1476 10737552⤵PID:1568
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1560 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"54⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1372 10916954⤵PID:1580
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1908 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"56⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f57⤵
- Creates scheduled task(s)
PID:1672 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"57⤵PID:988
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"58⤵PID:268
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 2028 12115056⤵PID:1060
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1816 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"58⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1956 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1956 12310058⤵PID:1496
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:828 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"60⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f61⤵
- Creates scheduled task(s)
PID:1884 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"61⤵PID:584
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"62⤵PID:1832
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 2024 12492560⤵PID:1876
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1584 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"62⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1816 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1816 12684462⤵PID:1064
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1460 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"64⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1048 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f65⤵
- Creates scheduled task(s)
PID:1472 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"65⤵PID:1044
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"66⤵
- Drops startup file
- Loads dropped DLL
- NTFS ADS
PID:1900 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"67⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1308 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"68⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1344 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f69⤵
- Creates scheduled task(s)
PID:1164 -
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"69⤵PID:628
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"70⤵PID:1548
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1344 13074468⤵PID:1916
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"69⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1172 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"70⤵PID:1560
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8OiJL4WJP46M.bat" "71⤵
- Loads dropped DLL
PID:1008 -
C:\Windows\SysWOW64\chcp.comchcp 6500172⤵PID:2036
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost72⤵
- Runs ping.exe
PID:1880 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"72⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:292 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"73⤵PID:1200
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\YQSRBa1Qn6Uk.bat" "74⤵
- Loads dropped DLL
PID:1704 -
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵PID:916
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost75⤵
- Runs ping.exe
PID:1724 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"75⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:820 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"76⤵PID:1792
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JICzjauT420W.bat" "77⤵
- Loads dropped DLL
PID:1576 -
C:\Windows\SysWOW64\chcp.comchcp 6500178⤵PID:1640
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost78⤵
- Runs ping.exe
PID:624 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:688 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵PID:592
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4wK2yfBAZ1c.bat" "80⤵
- Loads dropped DLL
PID:1136 -
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵PID:2036
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost81⤵
- Runs ping.exe
PID:908 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:1176
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:828
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\yfHGlIAadULa.bat" "83⤵PID:2528
-
C:\Windows\SysWOW64\chcp.comchcp 6500184⤵PID:2580
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost84⤵
- Runs ping.exe
PID:2604 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"84⤵PID:2900
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 828 17894882⤵PID:1836
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:2616
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 592 15205479⤵PID:1032
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:2008
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:1848
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mb0UE7LKJnlA.bat" "82⤵PID:2032
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵PID:2136
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost83⤵
- Runs ping.exe
PID:1412 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1848 18364481⤵PID:2096
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1792 13729676⤵PID:872
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"77⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1940 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵PID:844
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\p8NOwmk8yeLP.bat" "79⤵
- Loads dropped DLL
PID:596 -
C:\Windows\SysWOW64\chcp.comchcp 6500180⤵PID:1880
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost80⤵
- Runs ping.exe
PID:1788 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:592 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:984
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\TrEjjjoe1QuX.bat" "82⤵PID:2828
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵PID:2964
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost83⤵
- Runs ping.exe
PID:2996 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:2124
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 984 17883981⤵PID:1816
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:3060
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 844 15118078⤵PID:608
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵PID:1768
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:820
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\yFlh6r1PkHTx.bat" "81⤵PID:1928
-
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵PID:1352
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
PID:1992 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 820 17880880⤵PID:1212
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1200 13489473⤵PID:1712
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"74⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:328 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"75⤵PID:972
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\saTn288hlVs4.bat" "76⤵
- Loads dropped DLL
PID:1052 -
C:\Windows\SysWOW64\chcp.comchcp 6500177⤵PID:360
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost77⤵
- Runs ping.exe
PID:840 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"77⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:796 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵PID:1716
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ESjcPSuGwQkw.bat" "79⤵
- Loads dropped DLL
PID:1416 -
C:\Windows\SysWOW64\chcp.comchcp 6500180⤵PID:900
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost80⤵
- Runs ping.exe
PID:1956 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:364 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:784
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\fI1pJ7KOwnrL.bat" "82⤵
- Loads dropped DLL
PID:1944 -
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵PID:1756
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost83⤵
- Runs ping.exe
PID:1716 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:808
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"84⤵PID:684
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 684 18888684⤵PID:2736
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 784 15428481⤵PID:888
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:128
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:280
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ZClbx4yk95id.bat" "84⤵PID:2060
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵PID:2252
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost85⤵
- Runs ping.exe
PID:2452 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 280 18434683⤵PID:2496
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1716 14320878⤵PID:1676
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:276 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:1744
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PrnViU7lhFPF.bat" "81⤵
- Loads dropped DLL
PID:1340 -
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵PID:1712
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
PID:1204 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:940
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:916
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\qLJeqvjVEIJZ.bat" "84⤵PID:3068
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵PID:2108
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost85⤵
- Runs ping.exe
PID:2996 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 916 18358183⤵PID:2228
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1744 15306880⤵PID:292
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:996
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:596
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 596 18373782⤵PID:2280
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 972 13745275⤵PID:1744
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"76⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1924 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"77⤵PID:1068
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2M30PN1h7zuk.bat" "78⤵
- Loads dropped DLL
PID:1704 -
C:\Windows\SysWOW64\chcp.comchcp 6500179⤵PID:948
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost79⤵
- Runs ping.exe
PID:1460 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1116 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:832
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Ug0tjLXPcgJs.bat" "81⤵
- Loads dropped DLL
PID:1900 -
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵PID:964
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
PID:1268 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:1624
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:968
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JdMq2siOPt26.bat" "84⤵PID:920
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵PID:2488
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost85⤵
- Runs ping.exe
PID:1188 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 968 18663983⤵PID:984
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 832 15465980⤵PID:640
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:1908
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:108
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 108 18751382⤵PID:2300
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1068 14199277⤵PID:916
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:964 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵PID:580
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\L1K9NN8Yad9f.bat" "80⤵
- Loads dropped DLL
PID:1484 -
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵PID:108
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost81⤵
- Runs ping.exe
PID:1352 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1184 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:364
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\atrCJE8H32IL.bat" "83⤵PID:2724
-
C:\Windows\SysWOW64\chcp.comchcp 6500184⤵PID:2892
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost84⤵
- Runs ping.exe
PID:2928 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"84⤵PID:2296
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 364 17626582⤵PID:2020
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:2684
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 580 15316179⤵PID:896
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:380
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:1132
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dDulYsxqHVJ3.bat" "82⤵PID:2600
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵PID:1992
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost83⤵
- Runs ping.exe
PID:2692 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1132 18347281⤵PID:2088
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1560 13291270⤵PID:1484
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"71⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:624 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"72⤵PID:592
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2IfvKEVjIi8h.bat" "73⤵
- Loads dropped DLL
PID:960 -
C:\Windows\SysWOW64\chcp.comchcp 6500174⤵PID:892
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost74⤵
- Runs ping.exe
PID:1184 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"74⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:580 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"75⤵PID:1392
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GXyHdYlWYy0h.bat" "76⤵
- Loads dropped DLL
PID:660 -
C:\Windows\SysWOW64\chcp.comchcp 6500177⤵PID:592
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost77⤵
- Runs ping.exe
PID:996 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"77⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1824 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵PID:1068
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jSV8lJ3v9tNq.bat" "79⤵
- Loads dropped DLL
PID:1920 -
C:\Windows\SysWOW64\chcp.comchcp 6500180⤵PID:1076
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost80⤵
- Runs ping.exe
PID:1596 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:1648
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:1508
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jQdUeu4zmca4.bat" "82⤵PID:2760
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵PID:2904
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost83⤵
- Runs ping.exe
PID:2948 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:2604
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1508 17888681⤵PID:1496
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:2876
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1068 15196078⤵PID:904
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵PID:1928
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:840
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3Lo57h20rdQc.bat" "81⤵PID:2696
-
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵PID:2964
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
PID:2064 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 840 18294280⤵PID:2168
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1392 14061975⤵PID:1448
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"76⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1264 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"77⤵PID:536
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mX5DoTjzM3X8.bat" "78⤵
- Loads dropped DLL
PID:1584 -
C:\Windows\SysWOW64\chcp.comchcp 6500179⤵PID:1720
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost79⤵
- Runs ping.exe
PID:1708 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:828 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:1048
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Ypi5XMBsRwtF.bat" "81⤵
- Loads dropped DLL
PID:1004 -
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵PID:528
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
PID:968 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:528
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:2012
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 2012 18784083⤵PID:2676
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1048 16395780⤵PID:1276
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:288
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:2204
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 536 14667277⤵PID:1920
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1492 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵PID:1240
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FvHlMX7yTHC1.bat" "80⤵
- Loads dropped DLL
PID:1208 -
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵PID:928
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost81⤵
- Runs ping.exe
PID:296 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:804
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:1184
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1240 15434779⤵PID:1456
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:1956
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:1460
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\w2x1fYWmRtEG.bat" "82⤵PID:2664
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵PID:2844
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost83⤵
- Runs ping.exe
PID:2872 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"83⤵PID:2200
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1460 18039981⤵PID:1020
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:1676
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 592 13550272⤵PID:680
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"73⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1612 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"74⤵PID:1836
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\5GyHBqhsJLjA.bat" "75⤵
- Loads dropped DLL
PID:1844 -
C:\Windows\SysWOW64\chcp.comchcp 6500176⤵PID:1876
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost76⤵
- Runs ping.exe
PID:984 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"76⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1624 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"77⤵PID:1608
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ItSWjJpNYe40.bat" "78⤵
- Loads dropped DLL
PID:888 -
C:\Windows\SysWOW64\chcp.comchcp 6500179⤵PID:1884
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost79⤵
- Runs ping.exe
PID:1236 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1012 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:948
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\9Qyl0XVmetif.bat" "81⤵
- Loads dropped DLL
PID:1780 -
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵PID:1352
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
PID:1860 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:1076
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 948 16752980⤵PID:1448
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:608
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:3000
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1608 14629777⤵PID:1208
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1472 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵PID:2024
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B0dDI6Xh9aDH.bat" "80⤵
- Loads dropped DLL
PID:1616 -
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵PID:956
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost81⤵
- Runs ping.exe
PID:1192 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:700
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"82⤵PID:2152
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 2024 16035379⤵PID:1844
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:300
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:1276
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3yntOOr0SbeQ.bat" "82⤵PID:1436
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵PID:1708
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost83⤵
- Runs ping.exe
PID:2304 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1276 18623381⤵PID:1860
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1836 13921574⤵PID:364
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"75⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:992 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"76⤵PID:1004
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\e8iXpwnw8bi5.bat" "77⤵
- Loads dropped DLL
PID:1816 -
C:\Windows\SysWOW64\chcp.comchcp 6500178⤵PID:1700
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost78⤵
- Runs ping.exe
PID:1200 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:300 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵PID:924
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jCtGiOqasgsx.bat" "80⤵
- Loads dropped DLL
PID:1256 -
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵PID:1852
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost81⤵
- Runs ping.exe
PID:836 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:952
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 924 16487779⤵PID:1824
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:1044
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:832
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1004 14659476⤵PID:1560
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"77⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1996 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"78⤵PID:1256
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ANJxDLtuxz6w.bat" "79⤵
- Loads dropped DLL
PID:944 -
C:\Windows\SysWOW64\chcp.comchcp 6500180⤵PID:1200
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost80⤵
- Runs ping.exe
PID:1068 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:1348
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"81⤵PID:640
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1256 16372378⤵PID:768
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"79⤵PID:892
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"80⤵PID:2112
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1048 12857664⤵PID:1732
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"65⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1964 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"66⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1512 13021466⤵PID:280
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"67⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1288 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"68⤵PID:1888
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1yZWiNVBnmKB.bat" "69⤵
- Loads dropped DLL
PID:1256 -
C:\Windows\SysWOW64\chcp.comchcp 6500170⤵PID:1404
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost70⤵
- Runs ping.exe
PID:2008 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"70⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:908 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"71⤵PID:1464
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mTJsY3DFfh4k.bat" "72⤵
- Loads dropped DLL
PID:1660 -
C:\Windows\SysWOW64\chcp.comchcp 6500173⤵PID:956
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost73⤵
- Runs ping.exe
PID:1208 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"73⤵PID:980
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"74⤵PID:284
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hLOpQoDiA4KJ.bat" "75⤵PID:2068
-
C:\Windows\SysWOW64\chcp.comchcp 6500176⤵PID:2252
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost76⤵
- Runs ping.exe
PID:2304 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"76⤵PID:2368
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 284 18230274⤵PID:844
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"75⤵PID:2756
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1464 15239771⤵PID:1264
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"72⤵PID:1384
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"73⤵PID:340
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Lo77oLzVoAvY.bat" "74⤵PID:1064
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵PID:2356
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost75⤵
- Runs ping.exe
PID:2360 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 340 17888673⤵PID:1380
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"74⤵PID:324
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1888 13874768⤵PID:780
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"69⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1860 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"70⤵PID:1888
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\bQ9dV6HsKSLz.bat" "71⤵
- Loads dropped DLL
PID:1212 -
C:\Windows\SysWOW64\chcp.comchcp 6500172⤵PID:1560
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost72⤵
- Runs ping.exe
PID:604 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"72⤵PID:1964
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"73⤵PID:604
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RUevAkrv2Jza.bat" "74⤵PID:924
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵PID:3008
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost75⤵
- Runs ping.exe
PID:672 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 604 18319173⤵PID:2468
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 1888 15108670⤵PID:1588
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"71⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:624 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"72⤵PID:2032
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1Q16DDo1KCwa.bat" "73⤵
- Loads dropped DLL
PID:2240 -
C:\Windows\SysWOW64\chcp.comchcp 6500174⤵PID:2296
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost74⤵
- Runs ping.exe
PID:2308 -
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"74⤵PID:2024
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 2032 17472172⤵PID:692
-
C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"73⤵PID:2292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:1616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:1648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1272
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:2036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1040
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:692
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1472