Analysis
- max time kernel
150s - max time network
154s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
document-1695595102.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1695595102.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1695595102.xlsb
- Size 291KB
- Sample201113-s2zpc9sacn
- SHA256 146f0abab575bb8789501c1bf97f0c51ee64aacbd376faafb74cfe20eac77063
- MD5 6c21d34cd5fb6a1f0986bae070c5cb4c
- SHA1 b95078174d1cc4567d403f4abdfdfc37d8597687
- SHA512 d71c7edac048744e3e5743b47023c25365d38e10f02790a899a9fb9fe38a37b15835a4987bf425f41ffa1fb51de2c7640d0ec49df4c6ffe5fa1268a38d74de07
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
pid Process 3496 fwpxeohi.exe 2140 473B.exe 3896 473B.exe 2132 tizooky.exe 796 tizooky.exe - Loads dropped DLL 1 IoCs
pid Process 3496 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 473B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc tizooky.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 473B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 473B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 tizooky.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service tizooky.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 tizooky.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 473B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 473B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 473B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service tizooky.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc tizooky.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1612 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2484 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 1290 IoCs
pid Process 3496 fwpxeohi.exe 3496 fwpxeohi.exe 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2140 473B.exe 2140 473B.exe 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 732 explorer.exe 732 explorer.exe 3756 explorer.exe 3756 explorer.exe 1396 explorer.exe 1396 explorer.exe 3832 explorer.exe 3832 explorer.exe 732 explorer.exe 732 explorer.exe 736 explorer.exe 736 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3896 473B.exe 3896 473B.exe 1240 explorer.exe 1240 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3896 473B.exe 3896 473B.exe 3644 explorer.exe 3644 explorer.exe 1068 explorer.exe 1068 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 3644 explorer.exe 3644 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 732 explorer.exe 732 explorer.exe 732 explorer.exe 732 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 736 explorer.exe 736 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 2132 tizooky.exe 2132 tizooky.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 1240 explorer.exe 1240 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 1068 explorer.exe 1068 explorer.exe 3644 explorer.exe 3644 explorer.exe 1068 explorer.exe 1068 explorer.exe 3644 explorer.exe 3644 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 796 tizooky.exe 3756 explorer.exe 796 tizooky.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 796 tizooky.exe 796 tizooky.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 2352 explorer.exe 2352 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 2352 explorer.exe 2352 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1396 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 1240 explorer.exe 3640 explorer.exe 3640 explorer.exe 1240 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 1240 explorer.exe 3640 explorer.exe 3644 explorer.exe 1396 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe 1068 explorer.exe 1068 explorer.exe 3640 explorer.exe 1240 explorer.exe 3640 explorer.exe 1240 explorer.exe 1396 explorer.exe 3644 explorer.exe 3644 explorer.exe 1396 explorer.exe 3756 explorer.exe 3756 explorer.exe 736 explorer.exe 736 explorer.exe - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 3496 fwpxeohi.exe 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2132 tizooky.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 2876 Process not Found Token: SeCreatePagefilePrivilege 2876 Process not Found Token: SeShutdownPrivilege 2876 Process not Found Token: SeCreatePagefilePrivilege 2876 Process not Found Token: SeShutdownPrivilege 2876 Process not Found Token: SeCreatePagefilePrivilege 2876 Process not Found - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE 2484 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2876 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3496 2484 EXCEL.EXE 78 PID 2484 wrote to memory of 3496 2484 EXCEL.EXE 78 PID 2484 wrote to memory of 3496 2484 EXCEL.EXE 78 PID 2876 wrote to memory of 2140 2876 Process not Found 80 PID 2876 wrote to memory of 2140 2876 Process not Found 80 PID 2876 wrote to memory of 2140 2876 Process not Found 80 PID 2876 wrote to memory of 904 2876 Process not Found 81 PID 2876 wrote to memory of 904 2876 Process not Found 81 PID 2876 wrote to memory of 904 2876 Process not Found 81 PID 2876 wrote to memory of 904 2876 Process not Found 81 PID 2876 wrote to memory of 2284 2876 Process not Found 82 PID 2876 wrote to memory of 2284 2876 Process not Found 82 PID 2876 wrote to memory of 2284 2876 Process not Found 82 PID 2876 wrote to memory of 1076 2876 Process not Found 83 PID 2876 wrote to memory of 1076 2876 Process not Found 83 PID 2876 wrote to memory of 1076 2876 Process not Found 83 PID 2876 wrote to memory of 1076 2876 Process not Found 83 PID 2876 wrote to memory of 732 2876 Process not Found 84 PID 2876 wrote to memory of 732 2876 Process not Found 84 PID 2876 wrote to memory of 732 2876 Process not Found 84 PID 2876 wrote to memory of 732 2876 Process not Found 84 PID 2876 wrote to memory of 3756 2876 Process not Found 85 PID 2876 wrote to memory of 3756 2876 Process not Found 85 PID 2876 wrote to memory of 3756 2876 Process not Found 85 PID 2876 wrote to memory of 3756 2876 Process not Found 85 PID 2140 wrote to memory of 3896 2140 473B.exe 86 PID 2140 wrote to memory of 3896 2140 473B.exe 86 PID 2140 wrote to memory of 3896 2140 473B.exe 86 PID 2876 wrote to memory of 1396 2876 Process not Found 87 PID 2876 wrote to memory of 1396 2876 Process not Found 87 PID 2876 wrote to memory of 1396 2876 Process not Found 87 PID 2876 wrote to memory of 3832 2876 Process not Found 88 PID 2876 wrote to memory of 3832 2876 Process not Found 88 PID 2876 wrote to memory of 3832 2876 Process not Found 88 PID 2876 wrote to memory of 3832 2876 Process not Found 88 PID 2876 wrote to memory of 736 2876 Process not Found 89 PID 2876 wrote to memory of 736 2876 Process not Found 89 PID 2876 wrote to memory of 736 2876 Process not Found 89 PID 2876 wrote to memory of 3644 2876 Process not Found 90 PID 2876 wrote to memory of 3644 2876 Process not Found 90 PID 2876 wrote to memory of 3644 2876 Process not Found 90 PID 2876 wrote to memory of 3644 2876 Process not Found 90 PID 2876 wrote to memory of 1240 2876 Process not Found 91 PID 2876 wrote to memory of 1240 2876 Process not Found 91 PID 2876 wrote to memory of 1240 2876 Process not Found 91 PID 2876 wrote to memory of 580 2876 Process not Found 92 PID 2876 wrote to memory of 580 2876 Process not Found 92 PID 2876 wrote to memory of 580 2876 Process not Found 92 PID 2876 wrote to memory of 580 2876 Process not Found 92 PID 2876 wrote to memory of 1828 2876 Process not Found 93 PID 2876 wrote to memory of 1828 2876 Process not Found 93 PID 2876 wrote to memory of 1828 2876 Process not Found 93 PID 2876 wrote to memory of 1828 2876 Process not Found 93 PID 2876 wrote to memory of 1068 2876 Process not Found 94 PID 2876 wrote to memory of 1068 2876 Process not Found 94 PID 2876 wrote to memory of 1068 2876 Process not Found 94 PID 2876 wrote to memory of 1068 2876 Process not Found 94 PID 2876 wrote to memory of 3640 2876 Process not Found 95 PID 2876 wrote to memory of 3640 2876 Process not Found 95 PID 2876 wrote to memory of 3640 2876 Process not Found 95 PID 2876 wrote to memory of 2176 2876 Process not Found 96 PID 2876 wrote to memory of 2176 2876 Process not Found 96 PID 2876 wrote to memory of 2176 2876 Process not Found 96 PID 2876 wrote to memory of 2176 2876 Process not Found 96 PID 2140 wrote to memory of 2132 2140 473B.exe 97 PID 2140 wrote to memory of 2132 2140 473B.exe 97 PID 2140 wrote to memory of 2132 2140 473B.exe 97 PID 2140 wrote to memory of 1612 2140 473B.exe 98 PID 2140 wrote to memory of 1612 2140 473B.exe 98 PID 2140 wrote to memory of 1612 2140 473B.exe 98 PID 2132 wrote to memory of 796 2132 tizooky.exe 100 PID 2132 wrote to memory of 796 2132 tizooky.exe 100 PID 2132 wrote to memory of 796 2132 tizooky.exe 100 PID 2132 wrote to memory of 2352 2132 tizooky.exe 101 PID 2132 wrote to memory of 2352 2132 tizooky.exe 101 PID 2132 wrote to memory of 2352 2132 tizooky.exe 101 PID 2132 wrote to memory of 2352 2132 tizooky.exe 101
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1695595102.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\473B.exeC:\Users\Admin\AppData\Local\Temp\473B.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\473B.exeC:\Users\Admin\AppData\Local\Temp\473B.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3896
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ompsarqre\tizooky.exeC:\Users\Admin\AppData\Roaming\Microsoft\Ompsarqre\tizooky.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:2132 -
C:\Users\Admin\AppData\Roaming\Microsoft\Ompsarqre\tizooky.exeC:\Users\Admin\AppData\Roaming\Microsoft\Ompsarqre\tizooky.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:796
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:2352
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ovqqzwd /tr "\"C:\Users\Admin\AppData\Local\Temp\473B.exe\" /I ovqqzwd" /SC ONCE /Z /ST 18:26 /ET 18:382⤵
- Creates scheduled task(s)
PID:1612
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:904
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2284
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1076
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:732
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3756
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1396
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3832
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:736
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3644
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1240
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:580
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1828
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1068
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3640
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2176