Analysis
- max time kernel
150s - max time network
154s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe
- Size 3.2MB
- Sample201110-12tyf7dmke
- SHA256 2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f
- MD5 7899ec0612ae36968cea29dab3310547
- SHA1 27bda499cb441cb88ab2f84a0fbd8434d969f02c
- SHA512 a239f0b1c4211212638fa344e1d827fd80a70f7f40aa816a48083b6520dd54ce3b84f9306a041f15f8c152828ae848e2d51cead7642c6dbadc765d51ed0dc68b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3116 CDS.exe 824 crypted.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0e854fbd4ebf23cba2d15e6c5f675a31.exe crypted.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0e854fbd4ebf23cba2d15e6c5f675a31.exe crypted.exe - Loads dropped DLL 1 IoCs
pid Process 3116 CDS.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\0e854fbd4ebf23cba2d15e6c5f675a31 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\crypted.exe\" .." crypted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0e854fbd4ebf23cba2d15e6c5f675a31 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\crypted.exe\" .." crypted.exe - JavaScript code in executable 2 IoCs
resource yara_rule behavioral2/files/0x000200000001ab57-1.dat js behavioral2/files/0x000200000001ab57-2.dat js - Suspicious behavior: EnumeratesProcesses 1958 IoCs
pid Process 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 3116 CDS.exe 3116 CDS.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe 824 crypted.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 824 crypted.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe Token: 33 824 crypted.exe Token: SeIncBasePriorityPrivilege 824 crypted.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3116 CDS.exe 3116 CDS.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 980 wrote to memory of 3116 980 2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe 74 PID 980 wrote to memory of 3116 980 2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe 74 PID 980 wrote to memory of 3116 980 2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe 74 PID 3116 wrote to memory of 824 3116 CDS.exe 76 PID 3116 wrote to memory of 824 3116 CDS.exe 76 PID 3116 wrote to memory of 824 3116 CDS.exe 76 PID 824 wrote to memory of 1168 824 crypted.exe 81 PID 824 wrote to memory of 1168 824 crypted.exe 81 PID 824 wrote to memory of 1168 824 crypted.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe"C:\Users\Admin\AppData\Local\Temp\2b1995968ff5b1b0c1bc81553052f425decebcb3333b9fc5b95343c4df69c33f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe" "crypted.exe" ENABLE4⤵PID:1168
-
-
-