Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
01/12/2022, 20:25
General
-
Target
a0e938be88679df44d7b0802d05393b4d0d59605a7ef4d31031110bd2d827bd4.exe
-
Size
287KB
-
MD5
fd1494f5e8ef0f8e62f3102edce4a4ce
-
SHA1
e30f399c9ab7ff896060b2dcbfe7ef429c0af840
-
SHA256
a0e938be88679df44d7b0802d05393b4d0d59605a7ef4d31031110bd2d827bd4
-
SHA512
afc5f1970e7eb05e74da24d93e342417eb719ebf91f0eaf946d0b6c33ae47c17f96e682a27e88b9753265c22dca1d41308640e02e878c804e6edbcd584f3fbaa
-
SSDEEP
6144:FvUGjA60ZiUr+Nh6EZzjKrog64nS4jVafZTbQyhQ:FvUI0USjjvWTbQuQ
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0e938be88679df44d7b0802d05393b4d0d59605a7ef4d31031110bd2d827bd4.exe"C:\Users\Admin\AppData\Local\Temp\a0e938be88679df44d7b0802d05393b4d0d59605a7ef4d31031110bd2d827bd4.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.exeC:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.exe -m1504:C:\Users\Admin\AppData\Local\Temp\a0e938be88679df44d7b0802d05393b4d0d59605a7ef4d31031110bd2d827bd4.exe -sC:\Windows\system322⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\adsmsext.exeC:\Windows\system32\adsmsext.exe -m1492:C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.exe -sC:\Windows\system323⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.exeC:\Windows\system32\api-ms-win-core-delayload-l1-1-0.exe -m1200:C:\Windows\SysWOW64\adsmsext.exe -sC:\Windows\system324⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\advapi32.exeC:\Windows\system32\advapi32.exe -m1516:C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.exe -sC:\Windows\system325⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\api-ms-win-service-winsvc-l1-1-0.exeC:\Windows\system32\api-ms-win-service-winsvc-l1-1-0.exe -m1932:C:\Windows\SysWOW64\advapi32.exe -sC:\Windows\system326⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.exeC:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.exe -m1352:C:\Windows\SysWOW64\api-ms-win-service-winsvc-l1-1-0.exe -sC:\Windows\system327⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.exeC:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.exe -m1676:C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.exe -sC:\Windows\system328⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\adprovider.exeC:\Windows\system32\adprovider.exe -m2012:C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.exe -sC:\Windows\system329⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\amxread.exeC:\Windows\system32\amxread.exe -m2008:C:\Windows\SysWOW64\adprovider.exe -sC:\Windows\system3210⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.exeC:\Windows\system32\api-ms-win-crt-conio-l1-1-0.exe -m1116:C:\Windows\SysWOW64\amxread.exe -sC:\Windows\system3211⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.exeC:\Windows\system32\api-ms-win-core-console-l1-1-0.exe -m1756:C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.exe -sC:\Windows\system3212⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.exeC:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.exe -m1896:C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.exe -sC:\Windows\system3213⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\adtschema.exeC:\Windows\system32\adtschema.exe -m1708:C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.exe -sC:\Windows\system3214⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\adsnt.exeC:\Windows\system32\adsnt.exe -m1616:C:\Windows\SysWOW64\adtschema.exe -sC:\Windows\system3215⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ActionCenterCPL.exeC:\Windows\system32\ActionCenterCPL.exe -m1728:C:\Windows\SysWOW64\adsnt.exe -sC:\Windows\system3216⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ACCTRES.exeC:\Windows\system32\ACCTRES.exe -m428:C:\Windows\SysWOW64\ActionCenterCPL.exe -sC:\Windows\system3217⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.exeC:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.exe -m2020:C:\Windows\SysWOW64\ACCTRES.exe -sC:\Windows\system3218⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.exeC:\Windows\system32\api-ms-win-core-memory-l1-1-0.exe -m1704:C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.exe -sC:\Windows\system3219⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ActionCenterCPL.exeC:\Windows\system32\ActionCenterCPL.exe -m1648:C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.exe -sC:\Windows\system3220⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\acledit.exeC:\Windows\system32\acledit.exe -m1820:C:\Windows\SysWOW64\ActionCenterCPL.exe -sC:\Windows\system3221⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.exeC:\Windows\system32\api-ms-win-crt-math-l1-1-0.exe -m1940:C:\Windows\SysWOW64\acledit.exe -sC:\Windows\system3222⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\acppage.exeC:\Windows\system32\acppage.exe -m1932:C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.exe -sC:\Windows\system3223⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ActionCenter.exeC:\Windows\system32\ActionCenter.exe -m1396:C:\Windows\SysWOW64\acppage.exe -sC:\Windows\system3224⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.exeC:\Windows\system32\api-ms-win-core-synch-l1-2-0.exe -m948:C:\Windows\SysWOW64\ActionCenter.exe -sC:\Windows\system3225⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aclui.exeC:\Windows\system32\aclui.exe -m888:C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.exe -sC:\Windows\system3226⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\accessibilitycpl.exeC:\Windows\system32\accessibilitycpl.exe -m1952:C:\Windows\SysWOW64\aclui.exe -sC:\Windows\system3227⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aeevts.exeC:\Windows\system32\aeevts.exe -m1776:C:\Windows\SysWOW64\accessibilitycpl.exe -sC:\Windows\system3228⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.exeC:\Windows\system32\api-ms-win-core-misc-l1-1-0.exe -m1376:C:\Windows\SysWOW64\aeevts.exe -sC:\Windows\system3229⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aaclient.exeC:\Windows\system32\aaclient.exe -m1648:C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.exe -sC:\Windows\system3230⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\advpack.exeC:\Windows\system32\advpack.exe -m432:C:\Windows\SysWOW64\aaclient.exe -sC:\Windows\system3231⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\adsldpc.exeC:\Windows\system32\adsldpc.exe -m1820:C:\Windows\SysWOW64\advpack.exe -sC:\Windows\system3232⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aecache.exeC:\Windows\system32\aecache.exe -m1044:C:\Windows\SysWOW64\adsldpc.exe -sC:\Windows\system3233⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\adsmsext.exeC:\Windows\system32\adsmsext.exe -m1320:C:\Windows\SysWOW64\aecache.exe -sC:\Windows\system3234⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.exeC:\Windows\system32\api-ms-win-core-synch-l1-2-0.exe -m1140:C:\Windows\SysWOW64\adsmsext.exe -sC:\Windows\system3235⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\adsmsext.exeC:\Windows\system32\adsmsext.exe -m1196:C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.exe -sC:\Windows\system3236⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.exeC:\Windows\system32\api-ms-win-crt-convert-l1-1-0.exe -m556:C:\Windows\SysWOW64\adsmsext.exe -sC:\Windows\system3237⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.exeC:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.exe -m1844:C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.exe -sC:\Windows\system3238⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aaclient.exeC:\Windows\system32\aaclient.exe -m1344:C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.exe -sC:\Windows\system3239⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aclui.exeC:\Windows\system32\aclui.exe -m1608:C:\Windows\SysWOW64\aaclient.exe -sC:\Windows\system3240⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\adsmsext.exeC:\Windows\system32\adsmsext.exe -m1032:C:\Windows\SysWOW64\aclui.exe -sC:\Windows\system3241⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.exeC:\Windows\system32\api-ms-win-core-io-l1-1-0.exe -m1180:C:\Windows\SysWOW64\adsmsext.exe -sC:\Windows\system3242⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.exeC:\Windows\system32\api-ms-win-core-synch-l1-1-0.exe -m608:C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.exe -sC:\Windows\system3243⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.exeC:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.exe -m1200:C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.exe -sC:\Windows\system3244⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aclui.exeC:\Windows\system32\aclui.exe -m2008:C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.exe -sC:\Windows\system3245⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.exeC:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.exe -m1544:C:\Windows\SysWOW64\aclui.exe -sC:\Windows\system3246⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.exeC:\Windows\system32\api-ms-win-core-xstate-l1-1-0.exe -m1732:C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.exe -sC:\Windows\system3247⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.exeC:\Windows\system32\api-ms-win-core-datetime-l1-1-0.exe -m1356:C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.exe -sC:\Windows\system3248⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ACCTRES.exeC:\Windows\system32\ACCTRES.exe -m540:C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.exe -sC:\Windows\system3249⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.exeC:\Windows\system32\api-ms-win-core-localization-l1-2-0.exe -m1220:C:\Windows\SysWOW64\ACCTRES.exe -sC:\Windows\system3250⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aclui.exeC:\Windows\system32\aclui.exe -m1788:C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.exe -sC:\Windows\system3251⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.exeC:\Windows\system32\api-ms-win-core-heap-l1-1-0.exe -m1488:C:\Windows\SysWOW64\aclui.exe -sC:\Windows\system3252⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aaclient.exeC:\Windows\system32\aaclient.exe -m1296:C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.exe -sC:\Windows\system3253⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\activeds.exeC:\Windows\system32\activeds.exe -m756:C:\Windows\SysWOW64\aaclient.exe -sC:\Windows\system3254⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aaclient.exeC:\Windows\system32\aaclient.exe -m1704:C:\Windows\SysWOW64\activeds.exe -sC:\Windows\system3255⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\AltTab.exeC:\Windows\system32\AltTab.exe -m1008:C:\Windows\SysWOW64\aaclient.exe -sC:\Windows\system3256⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\adprovider.exeC:\Windows\system32\adprovider.exe -m1928:C:\Windows\SysWOW64\AltTab.exe -sC:\Windows\system3257⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\adsldp.exeC:\Windows\system32\adsldp.exe -m1832:C:\Windows\SysWOW64\adprovider.exe -sC:\Windows\system3258⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\AdmTmpl.exeC:\Windows\system32\AdmTmpl.exe -m1660:C:\Windows\SysWOW64\adsldp.exe -sC:\Windows\system3259⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\accessibilitycpl.exeC:\Windows\system32\accessibilitycpl.exe -m1608:C:\Windows\SysWOW64\AdmTmpl.exe -sC:\Windows\system3260⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\capisp.exeC:\Windows\system32\capisp.exe -m2040:C:\Windows\SysWOW64\accessibilitycpl.exe -sC:\Windows\system3261⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\AdmTmpl.exeC:\Windows\system32\AdmTmpl.exe -m1760:C:\Windows\SysWOW64\capisp.exe -sC:\Windows\system3262⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ACCTRES.exeC:\Windows\system32\ACCTRES.exe -m1820:C:\Windows\SysWOW64\AdmTmpl.exe -sC:\Windows\system3263⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\aclui.exeC:\Windows\system32\aclui.exe -m2020:C:\Windows\SysWOW64\ACCTRES.exe -sC:\Windows\system3264⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.exeC:\Windows\system32\api-ms-win-crt-process-l1-1-0.exe -m1196:C:\Windows\SysWOW64\aclui.exe -sC:\Windows\system3265⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\acledit.exeC:\Windows\system32\acledit.exe -m556:C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.exe -sC:\Windows\system3266⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.exeC:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.exe -m1844:C:\Windows\SysWOW64\acledit.exe -sC:\Windows\system3267⤵
-
C:\Windows\SysWOW64\AltTab.exeC:\Windows\system32\AltTab.exe -m1112:C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.exe -sC:\Windows\system3268⤵
-
C:\Windows\SysWOW64\aclui.exeC:\Windows\system32\aclui.exe -m1932:C:\Windows\SysWOW64\AltTab.exe -sC:\Windows\system3269⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\actxprxy.exeC:\Windows\system32\actxprxy.exe -m1032:C:\Windows\SysWOW64\aclui.exe -sC:\Windows\system3270⤵
-
C:\Windows\SysWOW64\ACCTRES.exeC:\Windows\system32\ACCTRES.exe -m1728:C:\Windows\SysWOW64\actxprxy.exe -sC:\Windows\system3271⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\aaclient.exeC:\Windows\system32\aaclient.exe -m880:C:\Windows\SysWOW64\ACCTRES.exe -sC:\Windows\system3272⤵
-
C:\Windows\SysWOW64\activeds.exeC:\Windows\system32\activeds.exe -m620:C:\Windows\SysWOW64\aaclient.exe -sC:\Windows\system3273⤵
-
C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.exeC:\Windows\system32\api-ms-win-core-synch-l1-1-0.exe -m1576:C:\Windows\SysWOW64\activeds.exe -sC:\Windows\system3274⤵
-
C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.exeC:\Windows\system32\api-ms-win-core-timezone-l1-1-0.exe -m1952:C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.exe -sC:\Windows\system3275⤵
-
C:\Windows\SysWOW64\accessibilitycpl.exeC:\Windows\system32\accessibilitycpl.exe -m768:C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.exe -sC:\Windows\system3276⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.exeC:\Windows\system32\api-ms-win-core-fibers-l1-1-0.exe -m848:C:\Windows\SysWOW64\accessibilitycpl.exe -sC:\Windows\system3277⤵
-
C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.exeC:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.exe -m516:C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.exe -sC:\Windows\system3278⤵
-
C:\Windows\SysWOW64\acledit.exeC:\Windows\system32\acledit.exe -m1924:C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.exe -sC:\Windows\system3279⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\bitsperf.exeC:\Windows\system32\bitsperf.exe -m1896:C:\Windows\SysWOW64\acledit.exe -sC:\Windows\system3280⤵
-
C:\Windows\SysWOW64\aclui.exeC:\Windows\system32\aclui.exe -m1828:C:\Windows\SysWOW64\bitsperf.exe -sC:\Windows\system3281⤵
-
C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.exeC:\Windows\system32\api-ms-win-crt-heap-l1-1-0.exe -m1308:C:\Windows\SysWOW64\aclui.exe -sC:\Windows\system3282⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\amstream.exeC:\Windows\system32\amstream.exe -m2012:C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.exe -sC:\Windows\system3283⤵
-
C:\Windows\SysWOW64\activeds.exeC:\Windows\system32\activeds.exe -m1040:C:\Windows\SysWOW64\amstream.exe -sC:\Windows\system3284⤵
-
C:\Windows\SysWOW64\apds.exeC:\Windows\system32\apds.exe -m1920:C:\Windows\SysWOW64\activeds.exe -sC:\Windows\system3285⤵
-
C:\Windows\SysWOW64\activeds.exeC:\Windows\system32\activeds.exe -m1888:C:\Windows\SysWOW64\apds.exe -sC:\Windows\system3286⤵
-
C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.exeC:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.exe -m1668:C:\Windows\SysWOW64\activeds.exe -sC:\Windows\system3287⤵
-
C:\Windows\SysWOW64\acledit.exeC:\Windows\system32\acledit.exe -m556:C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.exe -sC:\Windows\system3288⤵
-
C:\Windows\SysWOW64\activeds.exeC:\Windows\system32\activeds.exe -m1844:C:\Windows\SysWOW64\acledit.exe -sC:\Windows\system3289⤵
-
C:\Windows\SysWOW64\ACCTRES.exeC:\Windows\system32\ACCTRES.exe -m976:C:\Windows\SysWOW64\activeds.exe -sC:\Windows\system3290⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\activeds.exeC:\Windows\system32\activeds.exe -m1884:C:\Windows\SysWOW64\ACCTRES.exe -sC:\Windows\system3291⤵
-
C:\Windows\SysWOW64\ACCTRES.exeC:\Windows\system32\ACCTRES.exe -m1080:C:\Windows\SysWOW64\activeds.exe -sC:\Windows\system3292⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\activeds.exeC:\Windows\system32\activeds.exe -m676:C:\Windows\SysWOW64\ACCTRES.exe -sC:\Windows\system3293⤵
-
C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.exeC:\Windows\system32\api-ms-win-core-misc-l1-1-0.exe -m2012:C:\Windows\SysWOW64\activeds.exe -sC:\Windows\system3294⤵
-
C:\Windows\SysWOW64\ACCTRES.exeC:\Windows\system32\ACCTRES.exe -m2020:C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.exe -sC:\Windows\system3295⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\accessibilitycpl.exeC:\Windows\system32\accessibilitycpl.exe -m2036:C:\Windows\SysWOW64\ACCTRES.exe -sC:\Windows\system3296⤵
-
C:\Windows\SysWOW64\ACCTRES.exeC:\Windows\system32\ACCTRES.exe -m1376:C:\Windows\SysWOW64\accessibilitycpl.exe -sC:\Windows\system3297⤵
-
C:\Windows\SysWOW64\accessibilitycpl.exeC:\Windows\system32\accessibilitycpl.exe -m1648:C:\Windows\SysWOW64\ACCTRES.exe -sC:\Windows\system3298⤵
-
C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.exeC:\Windows\system32\api-ms-win-core-heap-l1-1-0.exe -m1776:C:\Windows\SysWOW64\accessibilitycpl.exe -sC:\Windows\system3299⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\AltTab.exeC:\Windows\system32\AltTab.exe -m1620:C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.exe -sC:\Windows\system32100⤵
-
C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.exeC:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.exe -m1344:C:\Windows\SysWOW64\AltTab.exe -sC:\Windows\system32101⤵
-
C:\Windows\SysWOW64\amstream.exeC:\Windows\system32\amstream.exe -m1084:C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.exe -sC:\Windows\system32102⤵
-
C:\Windows\SysWOW64\aecache.exeC:\Windows\system32\aecache.exe -m1296:C:\Windows\SysWOW64\amstream.exe -sC:\Windows\system32103⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.exeC:\Windows\system32\api-ms-win-core-handle-l1-1-0.exe -m1036:C:\Windows\SysWOW64\aecache.exe -sC:\Windows\system32104⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.exeC:\Windows\system32\api-ms-win-core-file-l2-1-0.exe -m1456:C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.exe -sC:\Windows\system32105⤵
-
C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.exeC:\Windows\system32\api-ms-win-crt-utility-l1-1-0.exe -m1704:C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.exe -sC:\Windows\system32106⤵
-
C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.exeC:\Windows\system32\api-ms-win-core-misc-l1-1-0.exe -m1944:C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.exe -sC:\Windows\system32107⤵
-
C:\Windows\SysWOW64\amstream.exeC:\Windows\system32\amstream.exe -m1720:C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.exe -sC:\Windows\system32108⤵
-
C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.exeC:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.exe -m1624:C:\Windows\SysWOW64\amstream.exe -sC:\Windows\system32109⤵
-
C:\Windows\SysWOW64\amstream.exeC:\Windows\system32\amstream.exe -m1904:C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.exe -sC:\Windows\system32110⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.exeC:\Windows\system32\api-ms-win-core-string-l1-1-0.exe -m1604:C:\Windows\SysWOW64\amstream.exe -sC:\Windows\system32111⤵
-
C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.exeC:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.exe -m1308:C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.exe -sC:\Windows\system32112⤵
-
C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.exeC:\Windows\system32\api-ms-win-core-localization-l1-1-0.exe -m1156:C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.exe -sC:\Windows\system32113⤵
-
C:\Windows\SysWOW64\apds.exeC:\Windows\system32\apds.exe -m960:C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.exe -sC:\Windows\system32114⤵
-
C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.exeC:\Windows\system32\api-ms-win-core-debug-l1-1-0.exe -m300:C:\Windows\SysWOW64\apds.exe -sC:\Windows\system32115⤵
-
C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.exeC:\Windows\system32\api-ms-win-core-fibers-l1-1-0.exe -m628:C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.exe -sC:\Windows\system32116⤵
-
C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.exeC:\Windows\system32\api-ms-win-core-timezone-l1-1-0.exe -m1992:C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.exe -sC:\Windows\system32117⤵
-
C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.exeC:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.exe -m2036:C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.exe -sC:\Windows\system32118⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.exeC:\Windows\system32\api-ms-win-core-localization-l1-1-0.exe -m1220:C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.exe -sC:\Windows\system32119⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\amstream.exeC:\Windows\system32\amstream.exe -m1720:C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.exe -sC:\Windows\system32120⤵
-
C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.exeC:\Windows\system32\api-ms-win-core-synch-l1-1-0.exe -m740:C:\Windows\SysWOW64\amstream.exe -sC:\Windows\system32121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-