Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 07:43
Static task
static1
Behavioral task
behavioral1
Sample
59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe
Resource
win10v2004-20220812-en
General
-
Target
59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe
-
Size
1.2MB
-
MD5
7c8c74a8626f40a3757ca14d82344754
-
SHA1
4e42062b48ddf1ba7cddad983964791f73bc5359
-
SHA256
59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9
-
SHA512
7ba6d5c9aa71758ac9b2033470f0c138d7e35e7827e9077aba4c01febdfa23ff2d087cd0302162e68b83d7112986884a510ec9ff5b19d864be25c7afbbc0c5a6
-
SSDEEP
3072:niNNzHy8upR2SDfhtPTnmQZpKVeLUDNn+pSfRW/Lz0lnmJqSDmIK57fD6SXm/Mls:ppRFz3
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2312 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3468 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 444 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3916 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3824 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4480 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 224 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 1688 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 1496 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4888 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2956 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4752 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3776 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 1136 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3656 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3116 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3632 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 1312 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2520 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 932 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2584 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3000 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2716 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2284 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2384 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4776 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4012 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3396 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 756 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3252 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2948 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4468 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4620 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4204 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 448 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 176 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3024 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2620 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 2540 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4336 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4596 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 1688 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 1196 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 5080 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 692 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 1476 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4732 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 3064 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe Token: SeDebugPrivilege 4244 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 3468 2312 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 82 PID 2312 wrote to memory of 3468 2312 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 82 PID 3468 wrote to memory of 444 3468 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 84 PID 3468 wrote to memory of 444 3468 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 84 PID 444 wrote to memory of 3916 444 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 86 PID 444 wrote to memory of 3916 444 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 86 PID 3916 wrote to memory of 3824 3916 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 89 PID 3916 wrote to memory of 3824 3916 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 89 PID 3824 wrote to memory of 4480 3824 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 90 PID 3824 wrote to memory of 4480 3824 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 90 PID 4480 wrote to memory of 224 4480 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 91 PID 4480 wrote to memory of 224 4480 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 91 PID 224 wrote to memory of 1688 224 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 93 PID 224 wrote to memory of 1688 224 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 93 PID 1688 wrote to memory of 1496 1688 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 94 PID 1688 wrote to memory of 1496 1688 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 94 PID 1496 wrote to memory of 4888 1496 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 95 PID 1496 wrote to memory of 4888 1496 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 95 PID 4888 wrote to memory of 2956 4888 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 96 PID 4888 wrote to memory of 2956 4888 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 96 PID 2956 wrote to memory of 4752 2956 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 97 PID 2956 wrote to memory of 4752 2956 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 97 PID 4752 wrote to memory of 3776 4752 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 98 PID 4752 wrote to memory of 3776 4752 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 98 PID 3776 wrote to memory of 1136 3776 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 99 PID 3776 wrote to memory of 1136 3776 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 99 PID 1136 wrote to memory of 3656 1136 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 100 PID 1136 wrote to memory of 3656 1136 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 100 PID 3656 wrote to memory of 3116 3656 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 101 PID 3656 wrote to memory of 3116 3656 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 101 PID 3116 wrote to memory of 3632 3116 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 102 PID 3116 wrote to memory of 3632 3116 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 102 PID 3632 wrote to memory of 1312 3632 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 103 PID 3632 wrote to memory of 1312 3632 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 103 PID 1312 wrote to memory of 2520 1312 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 104 PID 1312 wrote to memory of 2520 1312 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 104 PID 2520 wrote to memory of 932 2520 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 105 PID 2520 wrote to memory of 932 2520 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 105 PID 932 wrote to memory of 2584 932 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 106 PID 932 wrote to memory of 2584 932 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 106 PID 2584 wrote to memory of 3000 2584 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 107 PID 2584 wrote to memory of 3000 2584 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 107 PID 3000 wrote to memory of 2716 3000 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 108 PID 3000 wrote to memory of 2716 3000 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 108 PID 2716 wrote to memory of 2284 2716 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 109 PID 2716 wrote to memory of 2284 2716 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 109 PID 2284 wrote to memory of 2384 2284 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 110 PID 2284 wrote to memory of 2384 2284 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 110 PID 2384 wrote to memory of 4776 2384 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 111 PID 2384 wrote to memory of 4776 2384 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 111 PID 4776 wrote to memory of 4012 4776 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 112 PID 4776 wrote to memory of 4012 4776 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 112 PID 4012 wrote to memory of 3396 4012 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 113 PID 4012 wrote to memory of 3396 4012 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 113 PID 3396 wrote to memory of 756 3396 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 114 PID 3396 wrote to memory of 756 3396 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 114 PID 756 wrote to memory of 3252 756 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 115 PID 756 wrote to memory of 3252 756 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 115 PID 3252 wrote to memory of 2948 3252 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 116 PID 3252 wrote to memory of 2948 3252 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 116 PID 2948 wrote to memory of 4468 2948 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 117 PID 2948 wrote to memory of 4468 2948 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 117 PID 4468 wrote to memory of 4620 4468 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 118 PID 4468 wrote to memory of 4620 4468 59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe"C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:448 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:176 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:692 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exeC:\Users\Admin\AppData\Local\Temp\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe50⤵PID:3680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\59e511172e6c7514de3f22230a397492c89390d1e2da03dd6a0d6080ac63b0a9.exe.log
Filesize224B
MD51e4f2a29e11dead55e61329942cd2b14
SHA14b3ec9b98797d2f734d67b47cc149546f21cf0af
SHA25628bbb0da12bd69adc9df324c01392655b788115aba7466f02c23e1ba09f789d4
SHA5122e28227d898486bfe1cea081df486464b214df50500786e30d6ee9e7d6391f3aacd2f1ed1d0eab60d518bbc79f20f32c226f00ffd70abfe9af45a746cb08416c