Analysis
-
max time kernel
36s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20/12/2021, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe
Resource
win7-en-20211208
General
-
Target
8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe
-
Size
6.9MB
-
MD5
0dbb370bd9561bebde04a63c0a967fac
-
SHA1
c9dab70144d92a29c46921581174cf85eda44147
-
SHA256
8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf
-
SHA512
5355290e6439ef568782d340778fe54184db7249f3619633ebebef51a6810b762be07c9cc82ef8c033896686d358b54e114764d17038a7cf9386b0f4fe77577a
Malware Config
Extracted
socelars
http://www.biohazardgraphics.com/
Extracted
vidar
49.1
915
https://noc.social/@sergeev46
https://c.im/@sergeev47
-
profile_id
915
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 2292 rundll32.exe 72 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/2888-277-0x0000000000419336-mapping.dmp family_redline behavioral1/memory/2636-312-0x0000000000419336-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 1 IoCs
resource yara_rule behavioral1/files/0x0006000000013902-159.dat family_socelars -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x0006000000013985-127.dat WebBrowserPassView -
Nirsoft 1 IoCs
resource yara_rule behavioral1/files/0x0006000000013985-127.dat Nirsoft -
Vidar Stealer 2 IoCs
resource yara_rule behavioral1/memory/360-245-0x0000000000890000-0x0000000000969000-memory.dmp family_vidar behavioral1/memory/360-246-0x0000000000400000-0x000000000088B000-memory.dmp family_vidar -
resource yara_rule behavioral1/files/0x0005000000014027-71.dat aspack_v212_v242 behavioral1/files/0x0005000000014027-72.dat aspack_v212_v242 behavioral1/files/0x0005000000014023-73.dat aspack_v212_v242 behavioral1/files/0x0005000000014023-74.dat aspack_v212_v242 behavioral1/files/0x0005000000014042-77.dat aspack_v212_v242 behavioral1/files/0x0005000000014042-78.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
pid Process 796 setup_installer.exe 980 setup_install.exe 1888 Fri18083e5484e3b1125.exe 2004 Fri1851cb1bc629c3ac0.exe 1948 Fri18046280a7b776.exe 1728 Fri189c37bee8c29eb6.exe 1272 Fri1894cce7d386.exe 1532 Fri18cee95a1359570.exe 1276 Fri18002ecda8e9b.exe 2028 Fri1845451c00c99718b.exe 320 Fri182efa7c2ad75046.exe 360 Fri184baf2e5e45.exe 1580 Fri18e44ec8c2.exe -
Loads dropped DLL 51 IoCs
pid Process 972 8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe 796 setup_installer.exe 796 setup_installer.exe 796 setup_installer.exe 796 setup_installer.exe 796 setup_installer.exe 796 setup_installer.exe 980 setup_install.exe 980 setup_install.exe 980 setup_install.exe 980 setup_install.exe 980 setup_install.exe 980 setup_install.exe 980 setup_install.exe 980 setup_install.exe 1180 cmd.exe 1776 cmd.exe 1776 cmd.exe 840 cmd.exe 844 cmd.exe 268 cmd.exe 1320 cmd.exe 1320 cmd.exe 2004 Fri1851cb1bc629c3ac0.exe 2004 Fri1851cb1bc629c3ac0.exe 1948 Fri18046280a7b776.exe 1948 Fri18046280a7b776.exe 1876 cmd.exe 1728 Fri189c37bee8c29eb6.exe 1728 Fri189c37bee8c29eb6.exe 1276 Fri18002ecda8e9b.exe 1276 Fri18002ecda8e9b.exe 1888 Fri18083e5484e3b1125.exe 1532 Fri18cee95a1359570.exe 1532 Fri18cee95a1359570.exe 1888 Fri18083e5484e3b1125.exe 1724 cmd.exe 1724 cmd.exe 1824 cmd.exe 1824 cmd.exe 608 cmd.exe 608 cmd.exe 320 Fri182efa7c2ad75046.exe 320 Fri182efa7c2ad75046.exe 1272 Fri1894cce7d386.exe 1272 Fri1894cce7d386.exe 360 Fri184baf2e5e45.exe 360 Fri184baf2e5e45.exe 1792 cmd.exe 2020 cmd.exe 2020 cmd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 ipinfo.io 25 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1960 980 WerFault.exe 28 1628 1532 WerFault.exe 44 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 972 wrote to memory of 796 972 8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe 27 PID 972 wrote to memory of 796 972 8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe 27 PID 972 wrote to memory of 796 972 8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe 27 PID 972 wrote to memory of 796 972 8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe 27 PID 972 wrote to memory of 796 972 8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe 27 PID 972 wrote to memory of 796 972 8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe 27 PID 972 wrote to memory of 796 972 8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe 27 PID 796 wrote to memory of 980 796 setup_installer.exe 28 PID 796 wrote to memory of 980 796 setup_installer.exe 28 PID 796 wrote to memory of 980 796 setup_installer.exe 28 PID 796 wrote to memory of 980 796 setup_installer.exe 28 PID 796 wrote to memory of 980 796 setup_installer.exe 28 PID 796 wrote to memory of 980 796 setup_installer.exe 28 PID 796 wrote to memory of 980 796 setup_installer.exe 28 PID 980 wrote to memory of 1780 980 setup_install.exe 30 PID 980 wrote to memory of 1780 980 setup_install.exe 30 PID 980 wrote to memory of 1780 980 setup_install.exe 30 PID 980 wrote to memory of 1780 980 setup_install.exe 30 PID 980 wrote to memory of 1780 980 setup_install.exe 30 PID 980 wrote to memory of 1780 980 setup_install.exe 30 PID 980 wrote to memory of 1780 980 setup_install.exe 30 PID 980 wrote to memory of 1512 980 setup_install.exe 31 PID 980 wrote to memory of 1512 980 setup_install.exe 31 PID 980 wrote to memory of 1512 980 setup_install.exe 31 PID 980 wrote to memory of 1512 980 setup_install.exe 31 PID 980 wrote to memory of 1512 980 setup_install.exe 31 PID 980 wrote to memory of 1512 980 setup_install.exe 31 PID 980 wrote to memory of 1512 980 setup_install.exe 31 PID 980 wrote to memory of 840 980 setup_install.exe 32 PID 980 wrote to memory of 840 980 setup_install.exe 32 PID 980 wrote to memory of 840 980 setup_install.exe 32 PID 980 wrote to memory of 840 980 setup_install.exe 32 PID 980 wrote to memory of 840 980 setup_install.exe 32 PID 980 wrote to memory of 840 980 setup_install.exe 32 PID 980 wrote to memory of 840 980 setup_install.exe 32 PID 980 wrote to memory of 1320 980 setup_install.exe 33 PID 980 wrote to memory of 1320 980 setup_install.exe 33 PID 980 wrote to memory of 1320 980 setup_install.exe 33 PID 980 wrote to memory of 1320 980 setup_install.exe 33 PID 980 wrote to memory of 1320 980 setup_install.exe 33 PID 980 wrote to memory of 1320 980 setup_install.exe 33 PID 980 wrote to memory of 1320 980 setup_install.exe 33 PID 980 wrote to memory of 1776 980 setup_install.exe 34 PID 980 wrote to memory of 1776 980 setup_install.exe 34 PID 980 wrote to memory of 1776 980 setup_install.exe 34 PID 980 wrote to memory of 1776 980 setup_install.exe 34 PID 980 wrote to memory of 1776 980 setup_install.exe 34 PID 980 wrote to memory of 1776 980 setup_install.exe 34 PID 980 wrote to memory of 1776 980 setup_install.exe 34 PID 980 wrote to memory of 844 980 setup_install.exe 35 PID 980 wrote to memory of 844 980 setup_install.exe 35 PID 980 wrote to memory of 844 980 setup_install.exe 35 PID 980 wrote to memory of 844 980 setup_install.exe 35 PID 980 wrote to memory of 844 980 setup_install.exe 35 PID 980 wrote to memory of 844 980 setup_install.exe 35 PID 980 wrote to memory of 844 980 setup_install.exe 35 PID 980 wrote to memory of 268 980 setup_install.exe 36 PID 980 wrote to memory of 268 980 setup_install.exe 36 PID 980 wrote to memory of 268 980 setup_install.exe 36 PID 980 wrote to memory of 268 980 setup_install.exe 36 PID 980 wrote to memory of 268 980 setup_install.exe 36 PID 980 wrote to memory of 268 980 setup_install.exe 36 PID 980 wrote to memory of 268 980 setup_install.exe 36 PID 980 wrote to memory of 1180 980 setup_install.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe"C:\Users\Admin\AppData\Local\Temp\8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵PID:1780
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵PID:284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:1512
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:1164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri18083e5484e3b1125.exe4⤵
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18083e5484e3b1125.exeFri18083e5484e3b1125.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S .\BXNQ.FG6⤵PID:1816
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1894cce7d386.exe4⤵
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1894cce7d386.exeFri1894cce7d386.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri18046280a7b776.exe4⤵
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18046280a7b776.exeFri18046280a7b776.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18046280a7b776.exeC:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18046280a7b776.exe6⤵PID:2636
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri189c37bee8c29eb6.exe4⤵
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri189c37bee8c29eb6.exeFri189c37bee8c29eb6.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\510dbe9a-013a-46e6-baf4-953ee4bdfe70.exe"C:\Users\Admin\AppData\Local\510dbe9a-013a-46e6-baf4-953ee4bdfe70.exe"6⤵PID:2992
-
-
C:\Users\Admin\AppData\Local\84b10cb2-5c8a-4350-90bc-062f9353ca91.exe"C:\Users\Admin\AppData\Local\84b10cb2-5c8a-4350-90bc-062f9353ca91.exe"6⤵PID:2064
-
-
C:\Users\Admin\AppData\Local\9f1a66ff-5978-491b-9a83-eba5cf8138ed.exe"C:\Users\Admin\AppData\Local\9f1a66ff-5978-491b-9a83-eba5cf8138ed.exe"6⤵PID:2152
-
-
C:\Users\Admin\AppData\Local\13ee6744-4a91-445e-b7a9-edcb8dbdd81b.exe"C:\Users\Admin\AppData\Local\13ee6744-4a91-445e-b7a9-edcb8dbdd81b.exe"6⤵PID:2872
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri18cee95a1359570.exe4⤵
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18cee95a1359570.exeFri18cee95a1359570.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\Pictures\Adobe Films\gbZQviSjcKZPcU59SznFE8iA.exe"C:\Users\Admin\Pictures\Adobe Films\gbZQviSjcKZPcU59SznFE8iA.exe"6⤵PID:2952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 15446⤵
- Program crash
PID:1628
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1851cb1bc629c3ac0.exe4⤵
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1851cb1bc629c3ac0.exeFri1851cb1bc629c3ac0.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\is-D8SPP.tmp\Fri1851cb1bc629c3ac0.tmp"C:\Users\Admin\AppData\Local\Temp\is-D8SPP.tmp\Fri1851cb1bc629c3ac0.tmp" /SL5="$30166,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1851cb1bc629c3ac0.exe"6⤵PID:1808
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1845451c00c99718b.exe /mixtwo4⤵
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1845451c00c99718b.exeFri1845451c00c99718b.exe /mixtwo5⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1845451c00c99718b.exeFri1845451c00c99718b.exe /mixtwo6⤵PID:988
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri18002ecda8e9b.exe4⤵
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18002ecda8e9b.exeFri18002ecda8e9b.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\fFBFHI.cPL",6⤵PID:548
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\fFBFHI.cPL",7⤵PID:2076
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri18e44ec8c2.exe4⤵
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18e44ec8c2.exeFri18e44ec8c2.exe5⤵
- Executes dropped EXE
PID:1580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri187c9124f51b.exe4⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri187c9124f51b.exeFri187c9124f51b.exe5⤵PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri182efa7c2ad75046.exe4⤵
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exeFri182efa7c2ad75046.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exeC:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe6⤵PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exeC:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe6⤵PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exeC:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe6⤵PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exeC:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe6⤵PID:2836
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exeC:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe6⤵PID:2888
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri18b5451cab3.exe4⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exeFri18b5451cab3.exe5⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\is-54PQF.tmp\Fri18b5451cab3.tmp"C:\Users\Admin\AppData\Local\Temp\is-54PQF.tmp\Fri18b5451cab3.tmp" /SL5="$10194,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe"6⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe"C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe" /SILENT7⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\is-ABD5M.tmp\Fri18b5451cab3.tmp"C:\Users\Admin\AppData\Local\Temp\is-ABD5M.tmp\Fri18b5451cab3.tmp" /SL5="$2019A,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe" /SILENT8⤵PID:1172
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri184baf2e5e45.exe4⤵
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri184baf2e5e45.exeFri184baf2e5e45.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri185ef293d31.exe4⤵
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri185ef293d31.exeFri185ef293d31.exe5⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri185ef293d31.exe"C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri185ef293d31.exe" -u6⤵PID:1528
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 4844⤵
- Program crash
PID:1960
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2656
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2804