Analysis
-
max time kernel
151s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 09:08
Behavioral task
behavioral1
Sample
4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe
Resource
win10v2004-20220812-en
General
-
Target
4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe
-
Size
374KB
-
MD5
6509cbef69f53a8d7c7b0ce827214c99
-
SHA1
82d1fab5531d9ea63f92c7db89683c514b276886
-
SHA256
4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7
-
SHA512
28fbf20d2520e34ee49519701aea6b3c007b9f44287a07ee05a4e5bd72c58edbcd8f3a6085a763e44ade9abfdf2656fec782ca6eb7f9520d847788a890474a9a
-
SSDEEP
6144:5YLibtVwumPlJewcLSmjlCExWrBF65RjRbsNW0kj1+EqJ+nTnmUA7pkAmIQyO2+h:HbtO58wclRr4u5HsN4x+BOmUArhORRT3
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1708 g1.exe 1944 g1.exe 1416 g1.exe 1932 g1.exe 860 g1.exe 316 g1.exe 1280 g1.exe 2032 g1.exe 1996 g1.exe 1908 g1.exe 1468 g1.exe 656 g1.exe 548 g1.exe 1580 g1.exe 1700 g1.exe 984 g1.exe 836 g1.exe 1056 g1.exe 1756 g1.exe 1048 g1.exe 1696 g1.exe 1732 g1.exe 2032 g1.exe 560 g1.exe 1908 g1.exe 764 g1.exe 1140 g1.exe 908 g1.exe 1752 g1.exe 1700 g1.exe 612 g1.exe 1800 g1.exe 1784 g1.exe 1052 g1.exe 928 g1.exe 1980 g1.exe 2008 g1.exe 1436 g1.exe 268 g1.exe 1072 g1.exe 1104 g1.exe 548 g1.exe 944 g1.exe 1376 g1.exe 1720 g1.exe 1772 g1.exe 904 g1.exe 1232 g1.exe 1988 g1.exe 1616 g1.exe 1996 g1.exe 1192 g1.exe 712 g1.exe 1744 g1.exe 524 g1.exe 1556 g1.exe 1960 g1.exe 1120 g1.exe 568 g1.exe 1132 g1.exe 1184 g1.exe 288 g1.exe 1604 g1.exe 1076 g1.exe -
Loads dropped DLL 1 IoCs
pid Process 364 4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1708 g1.exe Token: SeDebugPrivilege 1944 g1.exe Token: SeDebugPrivilege 1416 g1.exe Token: SeDebugPrivilege 1932 g1.exe Token: SeDebugPrivilege 860 g1.exe Token: SeDebugPrivilege 316 g1.exe Token: SeDebugPrivilege 1280 g1.exe Token: SeDebugPrivilege 2032 g1.exe Token: SeDebugPrivilege 1996 g1.exe Token: SeDebugPrivilege 1908 g1.exe Token: SeDebugPrivilege 1468 g1.exe Token: SeDebugPrivilege 656 g1.exe Token: SeDebugPrivilege 548 g1.exe Token: SeDebugPrivilege 1580 g1.exe Token: SeDebugPrivilege 1700 g1.exe Token: SeDebugPrivilege 984 g1.exe Token: SeDebugPrivilege 836 g1.exe Token: SeDebugPrivilege 1056 g1.exe Token: SeDebugPrivilege 1756 g1.exe Token: SeDebugPrivilege 1048 g1.exe Token: SeDebugPrivilege 1696 g1.exe Token: SeDebugPrivilege 1732 g1.exe Token: SeDebugPrivilege 2032 g1.exe Token: SeDebugPrivilege 560 g1.exe Token: SeDebugPrivilege 1908 g1.exe Token: SeDebugPrivilege 764 g1.exe Token: SeDebugPrivilege 1140 g1.exe Token: SeDebugPrivilege 908 g1.exe Token: SeDebugPrivilege 1752 g1.exe Token: SeDebugPrivilege 1700 g1.exe Token: SeDebugPrivilege 612 g1.exe Token: SeDebugPrivilege 1800 g1.exe Token: SeDebugPrivilege 1784 g1.exe Token: SeDebugPrivilege 1052 g1.exe Token: SeDebugPrivilege 928 g1.exe Token: SeDebugPrivilege 1980 g1.exe Token: SeDebugPrivilege 2008 g1.exe Token: SeDebugPrivilege 1436 g1.exe Token: SeDebugPrivilege 268 g1.exe Token: SeDebugPrivilege 1072 g1.exe Token: SeDebugPrivilege 1104 g1.exe Token: SeDebugPrivilege 548 g1.exe Token: SeDebugPrivilege 944 g1.exe Token: SeDebugPrivilege 1376 g1.exe Token: SeDebugPrivilege 1720 g1.exe Token: SeDebugPrivilege 1772 g1.exe Token: SeDebugPrivilege 904 g1.exe Token: SeDebugPrivilege 1232 g1.exe Token: SeDebugPrivilege 1988 g1.exe Token: SeDebugPrivilege 1616 g1.exe Token: SeDebugPrivilege 1996 g1.exe Token: SeDebugPrivilege 1192 g1.exe Token: SeDebugPrivilege 712 g1.exe Token: SeDebugPrivilege 1744 g1.exe Token: SeDebugPrivilege 524 g1.exe Token: SeDebugPrivilege 1556 g1.exe Token: SeDebugPrivilege 1960 g1.exe Token: SeDebugPrivilege 1120 g1.exe Token: SeDebugPrivilege 568 g1.exe Token: SeDebugPrivilege 1132 g1.exe Token: SeDebugPrivilege 1184 g1.exe Token: SeDebugPrivilege 288 g1.exe Token: SeDebugPrivilege 1604 g1.exe Token: SeDebugPrivilege 1076 g1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 364 wrote to memory of 1708 364 4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe 26 PID 364 wrote to memory of 1708 364 4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe 26 PID 364 wrote to memory of 1708 364 4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe 26 PID 364 wrote to memory of 1708 364 4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe 26 PID 1708 wrote to memory of 1944 1708 g1.exe 27 PID 1708 wrote to memory of 1944 1708 g1.exe 27 PID 1708 wrote to memory of 1944 1708 g1.exe 27 PID 1944 wrote to memory of 1416 1944 g1.exe 28 PID 1944 wrote to memory of 1416 1944 g1.exe 28 PID 1944 wrote to memory of 1416 1944 g1.exe 28 PID 1416 wrote to memory of 1932 1416 g1.exe 29 PID 1416 wrote to memory of 1932 1416 g1.exe 29 PID 1416 wrote to memory of 1932 1416 g1.exe 29 PID 1932 wrote to memory of 860 1932 g1.exe 30 PID 1932 wrote to memory of 860 1932 g1.exe 30 PID 1932 wrote to memory of 860 1932 g1.exe 30 PID 860 wrote to memory of 316 860 g1.exe 31 PID 860 wrote to memory of 316 860 g1.exe 31 PID 860 wrote to memory of 316 860 g1.exe 31 PID 316 wrote to memory of 1280 316 g1.exe 32 PID 316 wrote to memory of 1280 316 g1.exe 32 PID 316 wrote to memory of 1280 316 g1.exe 32 PID 1280 wrote to memory of 2032 1280 g1.exe 33 PID 1280 wrote to memory of 2032 1280 g1.exe 33 PID 1280 wrote to memory of 2032 1280 g1.exe 33 PID 2032 wrote to memory of 1996 2032 g1.exe 34 PID 2032 wrote to memory of 1996 2032 g1.exe 34 PID 2032 wrote to memory of 1996 2032 g1.exe 34 PID 1996 wrote to memory of 1908 1996 g1.exe 35 PID 1996 wrote to memory of 1908 1996 g1.exe 35 PID 1996 wrote to memory of 1908 1996 g1.exe 35 PID 1908 wrote to memory of 1468 1908 g1.exe 36 PID 1908 wrote to memory of 1468 1908 g1.exe 36 PID 1908 wrote to memory of 1468 1908 g1.exe 36 PID 1468 wrote to memory of 656 1468 g1.exe 37 PID 1468 wrote to memory of 656 1468 g1.exe 37 PID 1468 wrote to memory of 656 1468 g1.exe 37 PID 656 wrote to memory of 548 656 g1.exe 38 PID 656 wrote to memory of 548 656 g1.exe 38 PID 656 wrote to memory of 548 656 g1.exe 38 PID 548 wrote to memory of 1580 548 g1.exe 39 PID 548 wrote to memory of 1580 548 g1.exe 39 PID 548 wrote to memory of 1580 548 g1.exe 39 PID 1580 wrote to memory of 1700 1580 g1.exe 40 PID 1580 wrote to memory of 1700 1580 g1.exe 40 PID 1580 wrote to memory of 1700 1580 g1.exe 40 PID 1700 wrote to memory of 984 1700 g1.exe 41 PID 1700 wrote to memory of 984 1700 g1.exe 41 PID 1700 wrote to memory of 984 1700 g1.exe 41 PID 984 wrote to memory of 836 984 g1.exe 42 PID 984 wrote to memory of 836 984 g1.exe 42 PID 984 wrote to memory of 836 984 g1.exe 42 PID 836 wrote to memory of 1056 836 g1.exe 43 PID 836 wrote to memory of 1056 836 g1.exe 43 PID 836 wrote to memory of 1056 836 g1.exe 43 PID 1056 wrote to memory of 1756 1056 g1.exe 44 PID 1056 wrote to memory of 1756 1056 g1.exe 44 PID 1056 wrote to memory of 1756 1056 g1.exe 44 PID 1756 wrote to memory of 1048 1756 g1.exe 45 PID 1756 wrote to memory of 1048 1756 g1.exe 45 PID 1756 wrote to memory of 1048 1756 g1.exe 45 PID 1048 wrote to memory of 1696 1048 g1.exe 46 PID 1048 wrote to memory of 1696 1048 g1.exe 46 PID 1048 wrote to memory of 1696 1048 g1.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe"C:\Users\Admin\AppData\Local\Temp\4723efdca1f69b04580a11467bb6240c7a38fffe1e6d5bb8d7179bee837b2fc7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\g1.exe"C:\Users\Admin\AppData\Local\Temp\g1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:908 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:612 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:928 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:268 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:548 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:712 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:524 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:288 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe66⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe67⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe68⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe69⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe70⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe71⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe72⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe73⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe74⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe75⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe76⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe77⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe78⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe79⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe80⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe81⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe82⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe83⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe84⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe85⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe86⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe87⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe88⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe89⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe90⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe91⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe92⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe93⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe94⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe95⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe96⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe97⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe98⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe99⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe100⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe101⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe102⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe103⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe104⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe105⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe106⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe107⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe108⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe109⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe110⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe111⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe112⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe113⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe114⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe115⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe116⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe117⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe118⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe119⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe120⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe121⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\g1.exeC:\Users\Admin\AppData\Local\Temp\g1.exe122⤵PID:1288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-