Overview
overview
10Static
static
8b26138a0e...e7.exe
windows7_x64
108b26138a0e...e7.exe
windows10_x64
10afc65cb796...ce.dll
windows7_x64
10afc65cb796...ce.dll
windows10_x64
10b909f69f36...a9.dll
windows7_x64
10b909f69f36...a9.dll
windows10_x64
10c57d20e273...7b.exe
windows7_x64
10c57d20e273...7b.exe
windows10_x64
10Analysis
-
max time kernel
153s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 04:24
Static task
static1
Behavioral task
behavioral1
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win10-en-20211208
General
-
Target
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
-
Size
196KB
-
MD5
b11ea7564115dbf8de1d73c916d8caa2
-
SHA1
5c72eba30754f697f4ed1d0f3b344e4cd3dbd937
-
SHA256
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7
-
SHA512
7eed10a5fff17d16583ea8578eafcbf3d81fb98eb6e73a94e93d7c0286c1e47a979dffc874e0de57b873ff2c4a49f3f1d3306108c9cb70127ad58ec91abef6d9
Malware Config
Extracted
C:\readme.txt
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exedescription ioc process File renamed C:\Users\Admin\Pictures\DebugEdit.raw => C:\Users\Admin\Pictures\DebugEdit.raw.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\MoveInvoke.raw => C:\Users\Admin\Pictures\MoveInvoke.raw.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Pictures\PushCompress.tiff 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\PushCompress.tiff => C:\Users\Admin\Pictures\PushCompress.tiff.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\SaveRestore.png => C:\Users\Admin\Pictures\SaveRestore.png.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\UseRestart.png => C:\Users\Admin\Pictures\UseRestart.png.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe -
Drops desktop.ini file(s) 29 IoCs
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exedescription ioc process File opened for modification C:\Users\Public\Recorded TV\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Documents\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Music\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Music\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Videos\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Links\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe -
Drops file in Program Files directory 64 IoCs
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUTL.OLB 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files\Microsoft Games\FreeCell\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files\DVD Maker\fr-FR\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Technic.thmx 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Perspective.thmx 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSEvents.man 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CGMIMP32.HLP 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files\Microsoft Games\More Games\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Opulent.thmx 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apex.thmx 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files\Common Files\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Java\jre7\release 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVZIP.DIC 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\uninstall.log 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files\Reference Assemblies\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Custom.propdesc 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKIRMV.XML 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.log 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\THOCR.PSP 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\MSBuild\Microsoft\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Common Files\Services\verisign.bmp 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\descript.ion 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Grid.thmx 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSWORD.OLB 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files\Java\jdk1.7.0_80\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordcnvpxy.cnv 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\HideTest.html 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exepid process 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1164 vssvc.exe Token: SeRestorePrivilege 1164 vssvc.exe Token: SeAuditPrivilege 1164 vssvc.exe Token: SeIncreaseQuotaPrivilege 1552 WMIC.exe Token: SeSecurityPrivilege 1552 WMIC.exe Token: SeTakeOwnershipPrivilege 1552 WMIC.exe Token: SeLoadDriverPrivilege 1552 WMIC.exe Token: SeSystemProfilePrivilege 1552 WMIC.exe Token: SeSystemtimePrivilege 1552 WMIC.exe Token: SeProfSingleProcessPrivilege 1552 WMIC.exe Token: SeIncBasePriorityPrivilege 1552 WMIC.exe Token: SeCreatePagefilePrivilege 1552 WMIC.exe Token: SeBackupPrivilege 1552 WMIC.exe Token: SeRestorePrivilege 1552 WMIC.exe Token: SeShutdownPrivilege 1552 WMIC.exe Token: SeDebugPrivilege 1552 WMIC.exe Token: SeSystemEnvironmentPrivilege 1552 WMIC.exe Token: SeRemoteShutdownPrivilege 1552 WMIC.exe Token: SeUndockPrivilege 1552 WMIC.exe Token: SeManageVolumePrivilege 1552 WMIC.exe Token: 33 1552 WMIC.exe Token: 34 1552 WMIC.exe Token: 35 1552 WMIC.exe Token: SeIncreaseQuotaPrivilege 1552 WMIC.exe Token: SeSecurityPrivilege 1552 WMIC.exe Token: SeTakeOwnershipPrivilege 1552 WMIC.exe Token: SeLoadDriverPrivilege 1552 WMIC.exe Token: SeSystemProfilePrivilege 1552 WMIC.exe Token: SeSystemtimePrivilege 1552 WMIC.exe Token: SeProfSingleProcessPrivilege 1552 WMIC.exe Token: SeIncBasePriorityPrivilege 1552 WMIC.exe Token: SeCreatePagefilePrivilege 1552 WMIC.exe Token: SeBackupPrivilege 1552 WMIC.exe Token: SeRestorePrivilege 1552 WMIC.exe Token: SeShutdownPrivilege 1552 WMIC.exe Token: SeDebugPrivilege 1552 WMIC.exe Token: SeSystemEnvironmentPrivilege 1552 WMIC.exe Token: SeRemoteShutdownPrivilege 1552 WMIC.exe Token: SeUndockPrivilege 1552 WMIC.exe Token: SeManageVolumePrivilege 1552 WMIC.exe Token: 33 1552 WMIC.exe Token: 34 1552 WMIC.exe Token: 35 1552 WMIC.exe Token: SeIncreaseQuotaPrivilege 608 WMIC.exe Token: SeSecurityPrivilege 608 WMIC.exe Token: SeTakeOwnershipPrivilege 608 WMIC.exe Token: SeLoadDriverPrivilege 608 WMIC.exe Token: SeSystemProfilePrivilege 608 WMIC.exe Token: SeSystemtimePrivilege 608 WMIC.exe Token: SeProfSingleProcessPrivilege 608 WMIC.exe Token: SeIncBasePriorityPrivilege 608 WMIC.exe Token: SeCreatePagefilePrivilege 608 WMIC.exe Token: SeBackupPrivilege 608 WMIC.exe Token: SeRestorePrivilege 608 WMIC.exe Token: SeShutdownPrivilege 608 WMIC.exe Token: SeDebugPrivilege 608 WMIC.exe Token: SeSystemEnvironmentPrivilege 608 WMIC.exe Token: SeRemoteShutdownPrivilege 608 WMIC.exe Token: SeUndockPrivilege 608 WMIC.exe Token: SeManageVolumePrivilege 608 WMIC.exe Token: 33 608 WMIC.exe Token: 34 608 WMIC.exe Token: 35 608 WMIC.exe Token: SeIncreaseQuotaPrivilege 608 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1940 wrote to memory of 1656 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1656 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1656 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1656 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1656 wrote to memory of 1552 1656 cmd.exe WMIC.exe PID 1656 wrote to memory of 1552 1656 cmd.exe WMIC.exe PID 1656 wrote to memory of 1552 1656 cmd.exe WMIC.exe PID 1940 wrote to memory of 816 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 816 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 816 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 816 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 816 wrote to memory of 608 816 cmd.exe WMIC.exe PID 816 wrote to memory of 608 816 cmd.exe WMIC.exe PID 816 wrote to memory of 608 816 cmd.exe WMIC.exe PID 1940 wrote to memory of 1996 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1996 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1996 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1996 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1996 wrote to memory of 1800 1996 cmd.exe WMIC.exe PID 1996 wrote to memory of 1800 1996 cmd.exe WMIC.exe PID 1996 wrote to memory of 1800 1996 cmd.exe WMIC.exe PID 1940 wrote to memory of 996 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 996 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 996 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 996 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 996 wrote to memory of 1756 996 cmd.exe WMIC.exe PID 996 wrote to memory of 1756 996 cmd.exe WMIC.exe PID 996 wrote to memory of 1756 996 cmd.exe WMIC.exe PID 1940 wrote to memory of 1708 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1708 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1708 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1708 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1708 wrote to memory of 1636 1708 cmd.exe WMIC.exe PID 1708 wrote to memory of 1636 1708 cmd.exe WMIC.exe PID 1708 wrote to memory of 1636 1708 cmd.exe WMIC.exe PID 1940 wrote to memory of 1620 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1620 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1620 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1620 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1620 wrote to memory of 1444 1620 cmd.exe WMIC.exe PID 1620 wrote to memory of 1444 1620 cmd.exe WMIC.exe PID 1620 wrote to memory of 1444 1620 cmd.exe WMIC.exe PID 1940 wrote to memory of 1772 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1772 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1772 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1772 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1772 wrote to memory of 912 1772 cmd.exe WMIC.exe PID 1772 wrote to memory of 912 1772 cmd.exe WMIC.exe PID 1772 wrote to memory of 912 1772 cmd.exe WMIC.exe PID 1940 wrote to memory of 1604 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1604 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1604 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1604 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1604 wrote to memory of 2028 1604 cmd.exe WMIC.exe PID 1604 wrote to memory of 2028 1604 cmd.exe WMIC.exe PID 1604 wrote to memory of 2028 1604 cmd.exe WMIC.exe PID 1940 wrote to memory of 1192 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1192 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1192 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1940 wrote to memory of 1192 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 1192 wrote to memory of 1376 1192 cmd.exe WMIC.exe PID 1192 wrote to memory of 1376 1192 cmd.exe WMIC.exe PID 1192 wrote to memory of 1376 1192 cmd.exe WMIC.exe PID 1940 wrote to memory of 704 1940 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe"C:\Users\Admin\AppData\Local\Temp\8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9E6B4C83-E397-4517-8DA9-3484AF0AD84A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9E6B4C83-E397-4517-8DA9-3484AF0AD84A}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C39B6211-31BD-4714-8535-1220FA86C225}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C39B6211-31BD-4714-8535-1220FA86C225}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:608 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{00CC08EC-00AD-4AA8-AF16-B3F4F224E56A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{00CC08EC-00AD-4AA8-AF16-B3F4F224E56A}'" delete3⤵PID:1800
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9B0FF658-0C54-4EB3-9B69-1DA1FB9B2C27}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9B0FF658-0C54-4EB3-9B69-1DA1FB9B2C27}'" delete3⤵PID:1756
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD3219A2-9723-4FB9-975E-9F39890481B3}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD3219A2-9723-4FB9-975E-9F39890481B3}'" delete3⤵PID:1636
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5106A401-EE5E-40A2-BB45-05B36DB087C7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5106A401-EE5E-40A2-BB45-05B36DB087C7}'" delete3⤵PID:1444
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8183FD06-C119-473D-B4A2-E73D4BF85C63}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8183FD06-C119-473D-B4A2-E73D4BF85C63}'" delete3⤵PID:912
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AC1A004E-B2DB-49B0-9331-2F2CC053D3DA}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AC1A004E-B2DB-49B0-9331-2F2CC053D3DA}'" delete3⤵PID:2028
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ADB940AD-0A35-462E-9FEB-ACC3FC9BC5A1}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ADB940AD-0A35-462E-9FEB-ACC3FC9BC5A1}'" delete3⤵PID:1376
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7A2524F2-6C16-47EF-938D-0890A33A8DBA}'" delete2⤵PID:704
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7A2524F2-6C16-47EF-938D-0890A33A8DBA}'" delete3⤵PID:836
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{703828D3-18E3-4962-B702-5FA1F0BACDF6}'" delete2⤵PID:1308
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{703828D3-18E3-4962-B702-5FA1F0BACDF6}'" delete3⤵PID:1000
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{00AFFCD2-8CEA-41F5-8D20-3B81FD754182}'" delete2⤵PID:1792
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{00AFFCD2-8CEA-41F5-8D20-3B81FD754182}'" delete3⤵PID:288
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FC5D151-5000-4A63-8B37-619EA4D209F3}'" delete2⤵PID:820
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FC5D151-5000-4A63-8B37-619EA4D209F3}'" delete3⤵PID:1496
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164